Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 583COM/DCOM ResourcesYour application uses the process or impersonation identity when it calls COM-basedresources, such as serviced components. Client-side authentication andimpersonation levels are configured using the comAuthenticationLevel andcomImpersonation level attributes on the element inMachine.config.For more information and recommendations, see “Enterprise ServicesConsiderations” in Chapter 17, “Securing Your Application Server.”Denial of Service ConsiderationsASP.NET has the following features to help counteract denial of service attacks aimedat your ASP.NET applications:● POST requests are constrained by default to 4 megabytes (MB).● Clients are checked to ensure that they are still connected before requests arequeued for work. This is done in case an attacker sends multiple requests and thendisconnects them.● Request execution times out after a configurable limit.Configuration values are maintained on the element inMachine.config. The following code sample shows default settings from a version 1.1Machine.config:You might want to reduce the maxRequestLength attribute to prevent users fromuploading very large files. The maximum allowed value is 4 MB. In the Open Hackcompetition, the maxRequestLength was constrained to 1/2 MB as shown in thefollowing example: