Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 553For example, to apply machine-wide policy that cannot be overridden at theapplication level, use the following element:… machine-wide defaultsBy leaving the path attribute empty, you indicate that the settings apply to themachine, while allowOverride=“false” ensures that Web.config settings do notoverride the specified values. Any attempt to add elements in Web.config willgenerate an exception, even if the elements in Machine.config match with thoseof Web.config.Machine.Config and Web.Config GuidelinesSettings in Machine.config apply machine-level defaults for your server. Where youwant to enforce a particular configuration for all applications on your server, useallowOverride=“false” on the element as described above. This isparticularly appropriate for hosting scenarios, where you need to enforce aspects ofsecurity policy for all applications on the server.For those settings that can be configured on an individual application basis, it isnormal for the application to provide a Web.config file. While it is possible toconfigure individual applications from Machine.config using multiple elements, separate Web.config files provide deployment advantages and lead tosmaller Machine.config files.The main item to consider is which settings should be enforced by machine policy.This depends on your specific scenario. Some common scenarios follow:● Windows authentication. Consider a corporate intranet portal scenario where youwant authentication to be abstracted away from the application and controlled bythe organization through Active Directory. In this scenario, you can enforceWindows authentication, but allow individual applications to impersonate withthe following configuration: