Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 563Configure the MachineKeyThe element defines the encryption algorithms that are used toencrypt the Forms authentication cookie. This element also maintains encryptionkeys. For more information, see the “MachineKey” section in this chapter.Use Unique Cookie Names and PathsUse unique name and path attribute values. By ensuring unique names, you preventproblems that can occur when you host multiple applications on the same server.AuthorizationUnless a user has explicit permission to access a resource, such as a particular Webpage, a resource file, a directory, and so on, the configuration should deny access bydefault. ASP.NET provides two configurable gatekeepers that you can use to controlaccess to restricted resources. These are:● File Authorization. This gatekeeper is implemented by the ASP.NETFileAuthorizationModule HTTP module.●URL Authorization. This gatekeeper is implemented by the ASP.NETUrlAuthorizationModule HTTP module.File AuthorizationOnly applications that use Windows authentication and have the followingconfiguration can use this gatekeeper:This gatekeeper is automatically effective when you use Windows authentication,and there is no need to impersonate. To configure the gatekeeper, configure WindowsACLs on files and folders. Note that the gatekeeper only controls access to the filetypes mapped by IIS to the following ASP.NET ISAPI extension: Aspnet_isapi.dll.