Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 551If the same configuration element is used in Machine.config and in one or moreWeb.config files, the setting from the file lowest in the hierarchy overrides the higherlevelsettings. New configuration settings that are not applied at the machine levelcan also be applied to Web.config files and certain elements can clear the parent-levelsettings using the element.The following table shows where the combined configuration settings are obtainedfrom for a combination of Web requests that apply to Figure 19.2.Table 19.2 Applying Configuration SettingsHTTP Requesthttp://Server/AppRootCombined Settings Obtained FromMachine.configWeb.config (AppRoot v-dir)http://Server/AppRoot/SubDir1Machine.configWeb.config (AppRoot v-dir)Web.config (SubDir1)http://Server/AppRoot/SubDir2Machine.configWeb.config (AppRoot v-dir)http://Server/Subdir2Machine.configThe element is used for three main purposes:●●●To apply configuration settings to specific application files.To centralize administration by applying application-specific settings inMachine.config.To lock configuration settings to prevent override at the application level.The tag can be used in Machine.config or Web.config. WithMachine.config, if you specify the path, then it must be fully qualified and includethe Web site name, virtual directory name, and optionally, a subdirectory and filename. For example:. . .Note You must include the Web site name when using the location tag from Machine.config.