Improving Web Application Security: Threats and - CGISecurity

592 Part IV: Securing Your Network, Host, and ApplicationThe components of the architecture depicted by Figure 20.1 are summarized inTable 20.2.Table 20.2 Components of the Windows 2000 ASP.NET ArchitectureComponent DescriptionInetinfo.exe The main IIS process. A Windows service that runs under the local SYSTEMaccount.Aspnet_isapi.dllAspnet_filter.dllAspnet_wp.exeAspnet_state.exeIIS script mappings associate ASP.NET file types with this ASP.NET ISAPIextension that runs inside Inetinfo.exe. It is responsible for forwarding requeststo the ASP.NET worker process through an asynchronous named pipe. It alsostarts the worker process and performs health monitoring. The ISAPI extensioncontains no managed code and performs no request processing itself.A lightweight ISAPI filter used only to support cookie-less session state forASP.NET applications. Runs inside Inetinfo.exe.The ASP.NET worker process. Hosts multiple Web applications in separateapplication domains that are used to provide isolation. Generally one instanceper server, although on multi-processor servers, a Web garden mode supportsmultiple identical processes with an affinity for a given processor. It is notpossible to separate specific Web applications into different processes. Thisrequires IIS 6 and Windows Server 2003. Aspnet_wp.exe runs under the localASPNET account, although a custom account can be used.An optional Windows service used to store session state for ASP.NETapplications. It can run on the Web server or on a remote machine (required forWeb farm scenarios). It runs under the local ASPNET account, although acustom account can be used, configured via the Services snap-in.ASP.NET Architecture on Windows Server 2003On Windows Server 2003, the architecture changes because IIS 6 allows multipleprocesses to be used to host separate Web applications. This is shown in Figure 20.2.Note IIS 6 supports a backwards compatibility mode that, in turn, supports the IIS 5 ASP.NETworker process model.