Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 549Note Windows executables, such as WinForm applications, are configured using configuration files.The names of these files are derived from the application executable name, for example,App.exe.config, where app is the application name.Changes that you make to configuration files are applied dynamically and do notnormally require that you restart the server or any service, except if changes are madeto the element in Machine.config, which is discussed later in thischapter.Table 19.1 shows where the configuration files are located.Table 19.1 Configuration File LocationsConfiguration fileLocationMachine.config%windir%\Microsoft.NET\Framework\{version}\CONFIG(one per machine per installed versionof the .NET Framework)Web.config(zero, one, or many per application)\inetpub\wwwroot\web.config\inetpub\wwwroot\YourApplication\web.config\inetpub\wwwroot\YourApplication\SubDir\web.configEnterprisesec.config(enterprise-level CAS) configuration)Security.config(machine-level CAS configuration)Security.config(user-level CAS configuration)Web_hightrust.config%windir%\Microsoft.NET\Framework\{version}\CONFIG%windir%\Microsoft.NET\Framework\{version}\CONFIG\Documents and Settings\{user}\Application Data\Microsoft\CLR Security Config\{version}%windir%\Microsoft.NET\Framework\{version}\CONFIGWeb_mediumtrust.configWeb_lowtrust.configWeb_minimaltrust.config(ASP.NET Web application CASconfiguration)For more information about ASP.NET Web application CAS configuration files, seeChapter 9, “Using Code Access Security with ASP.NET.”