Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 383Restrict Unauthorized CodeBy using .NET Framework code access security — specifically, code identity demands— you can limit the assemblies that can access your data access classes and methods.For example, if you only want code written by your company or a specificdevelopment organization to be able to use your data access components, use aStrongNameIdentityPermission and demand that calling assemblies have a strongname with a specified public key, as shown in the following code fragment:using System.Security.Permissions;. . .[StrongNameIdentityPermission(SecurityAction.LinkDemand,PublicKey="002...4c6")]public void GetCustomerInfo(int CustId){}To extract a text representation of the public key for a given assembly, use thefollowing command:sn -Tp assembly.dllNote Use an uppercase “T” in the –Tp switch.Because Web application assemblies are dynamically compiled, you cannot usestrong names for these assemblies. This makes it difficult to restrict the use of a dataaccess assembly to a specific Web application. The best approach is to develop acustom permission and demand that permission from the data access component.Full trust Web applications (or any fully trusted code) can call your component.Partial trust code, however, can call your data access component only if it has beengranted the custom permission.For an example implementation of a custom permission, see “How To: Create aCustom Encryption Permission” in the “How To” section of this guide.Restrict the Application in the DatabaseThe preferred approach is to create a SQL Server login for the Windows account thatthe application uses to connect to the database. Then map the SQL Server login to adatabase user in your database. Place the database user in a user-defined databaserole and grant permissions to that role. Ideally, you should only grant the role executeaccess to the stored procedures used by the application.For details about how to configure this approach, see “Configuring Data Access forYour ASP.NET Application” in Chapter 19, “Securing Your ASP.NET Application andWeb Services.”