Improving Web Application Security: Threats and - CGISecurity

364 Part III: Building Secure Web Applications7. Decrypt the session encryption key using the private key of the server.AsymmetricKeyExchangeDeformatter asymDeformatter = newRSAPKCS1KeyExchangeDeformatter(_rsa);byte[] decryptedSessionKey = asymDeformatter.DecryptKeyExchange();8. Use a mechanism for mapping clients to encryption keys, for example, by using ahash table.At this point, the client and server both share an encryption key, and can encrypt anddecrypt method calls. Periodically during the object lifetime, new keys can andshould be created.Denial of ServiceDenial of service attacks can occur when a malicious client creates multiple objectsand continues to renew the lifetime lease to consume server resources. Server-sideremote objects contain a default lease. In this state, a client can continue to renew thelease forever. However, you can implement the ILease interface on the server andexplicitly control sponsors and renewals. To do this, overrideInitializeLifetimeService on your MarshalByRefObject object. The remotinginfrastructure calls this method when the object is created. The lease can also be setprogrammatically by using the element.Exception ManagementMake sure you do not return full exception details to the caller. If you use anASP.NET host, make sure ASP.NET is configured so that generic error messages arereturned to the client, as shown below.Use mode=“on” or mode=“remoteOnly”. Do not use mode=“off” on productionservers.