Improving Web Application Security: Threats and - CGISecurity

Chapter 20: Hosting Multiple Web Applications 601Forms Authentication IssuesIf you use Forms authentication with version 1.0 of the .NET Framework, you shoulduse separate cookie paths and names. If you do not do so, it is possible for a userauthenticated in one application to make a request to another application withoutbeing redirected to that application’s logon page. The URL authorization rules withinthe second application may deny access to the user, without providing theopportunity to supply logon credentials using the logon form.To avoid this issue, use unique cookie path and name attributes on the element for each application, and also use separate machine keys for eachapplication.Version 1.1 of the .NET Framework supports the IsolateApps setting shown below.This ensures that each application on the machine uses a separate key for encryptionand validation of Forms authentication cookies and view state.With version 1.0 of the .NET Framework, you cannot use IsolateApps and you mustmanually generate elements. For more information about this issue,see the following articles in the Microsoft Knowledge Base.● 313116, “PRB: Forms Authentication Requests Are Not Directed to loginUrl Page”●312906, “How To: Create Keys by Using Visual C# .NET for Use in FormsAuthentication”UNC Share HostingIf you run an application with its content on a Universal Naming Convention (UNC)share, the credentials used to access the share are either the credentials of theapplication or of the authenticated client. This is configured in IIS by anadministrator.When an application is configured in this manner, ASP.NET impersonates thesecurity context of the token it receives from IIS. This is not configurable with the tag unless explicit credentials are provided.With version 1.0 of the .NET Framework, use Mscorcfg.msc to create a code groupbased on the URL and to grant it full trust.When you use a virtual directory that points to a remote share to host an ASP.NETapplication, you may receive a security exception. For more information, seeMicrosoft Knowledge Base article 320268, “PRB: System.Security.SecurityException:Security error.”