Improving Web Application Security: Threats and - CGISecurity

564 Part IV: Securing Your Network, Host, and ApplicationURL AuthorizationAny application can use this gatekeeper. It is configured using elements that control which users and groups of users should have access to theapplication. The default element from Machine.config is shown below:URL Authorization NotesUse the following to help you successfully configure URL Authorization:●●●Authorization settings in Web.config usually refer to all of the files in the currentdirectory and all subdirectories, unless a subdirectory contains its own Web.configwith an element. In this case, the settings in the subdirectoryoverride the parent directory settings.URL authorization only applies to file types that are mapped by IIS to theASP.NET ISAPI extension: Aspnet_isapi.dll.When your application uses Windows authentication, you are authorizing accessto Windows user and group accounts. User names take the form of“authority\WindowsUserName” and role names take the form of“authority\WindowsGroupName”, where authority is either a domain name orthe local machine name depending on the account type.A number of well known accounts are represented with “BUILTIN”strings. For example, the local administrators group is referred to as“BUILTIN\Administrators”. The local users group is referred to as“BUILTIN\Users”.Note With.NET Framework version 1.0, the authority and the group name are case sensitive.The group name must match the group name that appears in Windows exactly.●When your application uses Forms authentication, you authorize the custom userand roles maintained in your custom user store. For example, if you use Forms toauthenticate users against a database, you authorize against the roles retrievedfrom the database.