Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 567 To limit the application’s login in the state database1. Create a duplicate local account on the state database server with the same nameand strong password of the account that runs your ASP.NET application.For more information about using the ASPNET account to access a remotedatabase, see “Data Access” later in this chapter.2. Create a local Windows group, for example ASPNETWebApps, on the databaseserver and add the local ASPNET account to the group.3. Grant the Windows group access to SQL Server by creating a new login.sp_grantlogin 'MACHINE\ASPNETWebApps'Note Replace MACHINE with your database server name.4. Grant the SQL login access to the ASPState database. The following T-SQL createsa database user called WebAppUser, with which the login is associated.USE ASPStateGOsp_grantdbaccess 'MACHINE\ASPNETWebApps', 'WebAppUser'5. Create a user-defined database role.USE ASPStateGOsp_addrole 'WebAppUserRole'6. Add the database user to the new database role.USE ASPStateGOsp_addrolemember 'WebAppUserRole', 'WebAppUser'7. Configure permissions in the database for the database role. Grant executepermissions for the stored procedures that are provided with the ASPStatedatabase.grant execute on CreateTempTables to WebAppUserRoleRepeat this command for all of the stored procedures that are provided with theASPState database. Use SQL Server Enterprise Manager to see the full list.