Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 547Generally, ASP.NET applications do not use impersonation because it can negativelyaffect design, implementation, and scalability. For example, using impersonationprevents effective middle-tier connection pooling, which limits application scalability.Impersonation might make sense in specific scenarios, for example, when theapplication uses the anonymous user account’s security context for resource access.This is a common technique often used when multiple applications are hosted on thesame server. For more information, see Chapter 20, “Hosting Multiple WebApplications.”HttpForbiddenHandler, Urlscan, and the 404.dllThere are a number of techniques you can use to prevent access to restrictedresources. ASP.NET provides the HttpForbiddenHandler to which you can mapASP.NET file types that should not be downloadable over HTTP. Mappings areapplied using the element.IISLockdown.exe provides the 404.dll. Using this, you can configure IIS to mapunwanted file extensions to the 404.dll, which results in the “HTTP 404 - File notfound” message when the file type is requested.Finally, the URLScan ISAPI filter can be used to block requests for restricted file typesand program executables. URLScan ships with the IISLockdown tool, although it canbe obtained separately. For more information, see Microsoft Knowledge Base article307608, “INFO: Availability of URLScan Version 2.5 Security Tool,” and “How To: UseURLScan” in the “How To” section of this guide.For more information about IISLockdown and URLScan, see Chapter 16, “SecuringYour Web Server.”AppSettingsThe element in Web.config allows applications to store configurationdata, such as database connection strings or service account credentials. Theadvantage of this element is that it allows developers to centralize and standardizethe storage and retrieval of configuration data. A single location in Web.config alsoeases administration and deployment.Sensitive data, such as connection strings and credentials, should not be stored inplaintext format in configuration files. Instead, the developer should use DPAPI toencrypt secrets prior to storage.For more information about AppSettings, see the “AppSettings in ASP.NET” show onMSDN ® TV at http://msdn.microsoft.com/msdntv.