Improving Web Application Security: Threats and - CGISecurity

552 Part IV: Securing Your Network, Host, and ApplicationWith Web.config, the path is relative from the application’s virtual directory. Forexample:. . .Applying Configuration Settings to Specific FilesUse the path attribute to apply configuration settings for a specific file. For example,to apply authorization rules to the file Pagename.aspx from within Web.config, usethe following element:Applying Application Configuration Settings in Machine.configYou can also apply application-specific settings in Machine.config by using statements that specify paths to application directories. This has theadvantage of centralizing administration. For example, the following fragment showshow to enforce the use of Windows authentication and prevent the use ofimpersonation in a particular application.Locking Configuration SettingsTo prevent individual applications from overriding machine-level policyconfiguration, place settings within a element in Machine.config and setthe allowOverride=“false” attribute.