Improving Web Application Security: Threats and - CGISecurity

360 Part III: Building Secure Web Applications2. Add the following line to the top of the file, and then save the file.3. Add an appropriately configured ACL to the file using Windows Explorer todetermine which users or user groups can and cannot access the object.Authorize Users with Principal-Based Role ChecksThe FileAuthorizationModule approach described above allows you to control whocan and cannot access the remote object. For finer grained authorization that can beapplied at the method level, you can perform authorization checks using theIPrincipal object attached to the current request.If your remote object is hosed by ASP.NET and you use Windows authentication, anIPrincipal object based on the authenticated caller’s Windows identity isautomatically created and attached to Thread.CurrentPrinicipal.If you use a custom host, create an IPrincipal object to represent the authenticateduser. The mechanics depend on your authentication approach. For example if you usea named pipe transport, you can impersonate the caller to obtain their identity andconstruct an IPrincipal object.With the IPrincipal object in place you can perform authorization using principalpermission demands both declaratively and imperatively and you can callIPrincipal.IsInRole.Consider Limiting Remote AccessIn some scenarios, where you use remoting for inter process or cross applicationdomain communication on a single computer, you can set rejectRemoteRequests totrue to ensure that your object cannot be accessed from remote computers as shownbelow.