Improving Web Application Security: Threats and - CGISecurity

666 Part V: Assessing Your SecurityAuthenticationServiced components can be hosted in a library application that runs in the client’sprocess address space or in a server application that runs in a separate instance ofDllhost.exe. This is determined by the activation type specified on the Activationpage of the application’s Properties dialog box in Component Services. The clientprocess for an Enterprise Services library application is usually the ASP.NET Webapplication process.The settings discussed below are specified on the Security page of the application’sProperties dialog box in Component Services.Server ApplicationsIf the Activation type is set to Server application, review the following questions:●●Do you prevent anonymous access?Check that your application uses at least call level authentication to ensure thatclients are authenticated each time they make a method call. This preventsanonymous access.What impersonation level do you use?Check to make sure that you use at least identify level impersonation to allowdownstream systems to identify your serviced component. By default, this isthe process identity determined by the run-as account of the application. Ifyour serviced components use programmatic impersonation, this may be animpersonated identity. Use delegate level only if you want the downstream systemto be able to access remote resources using your serviced component’s identity.Library ApplicationsIf the activation type is set to Library application, the authentication andimpersonation settings are inherited from the host process. The review questionsin this section assume the ASP.NET process is the host process.●Have you disabled authentication?To check, view the Enable authentication check box setting on the Security pageof the application’s Properties dialog box. You should not disable authenticationunless you have a specific requirement such as handling unauthenticatedcallbacks from a remote serviced component.