CRV2 FrameworkSpecIssuesASPNet - Revision history

Johanna Curiel at 12:06, 25 July 2013

2013-07-25T12:06:34Z

Johanna Curiel at 02:53, 25 July 2013

2013-07-25T02:53:43Z

Johanna Curiel at 02:51, 25 July 2013

2013-07-25T02:51:49Z

Johanna Curiel at 02:46, 25 July 2013

2013-07-25T02:46:20Z

Johanna Curiel at 21:37, 23 July 2013

2013-07-23T21:37:10Z

Johanna Curiel at 03:09, 14 July 2013

2013-07-14T03:09:40Z

Johanna Curiel at 03:09, 14 July 2013

2013-07-14T03:09:03Z

Johanna Curiel at 03:03, 14 July 2013

2013-07-14T03:03:28Z

Johanna Curiel at 03:00, 14 July 2013

2013-07-14T03:00:43Z

Johanna Curiel at 03:00, 14 July 2013

2013-07-14T03:00:27Z

@@ Line 19: / Line 19: @@
 ASP.NET configuration works only for its resources. Keep in mind that if you need to configure access to resources of files contained in your application such as .txt, .gif, .jpg, these are done through the IIS permissions.  For example, even though the ASP.NET resources in a directory might be forbidden by a Web.config file, users can still seethe files located in that directory if directory browsing is turned on and no other restrictions are in place.
 == Reference ==
 http://msdn.microsoft.com/en-us/library/bwd43d0x%28v=vs.85%29.aspx

@@ Line 6: / Line 6: @@
 [[File:Iis.png]]
 Enable and configure the necessary type of authentication based on the security level required by your application. ASP.NET membership and ASP.NET login controls implicitly work with forms authentication.
 ASP.NET configuration works only for its resources. Keep in mind that if you need to configure access to resources of files contained in your application such as .txt, .gif, .jpg, these are done through the IIS permissions.  For example, even though the ASP.NET resources in a directory might be forbidden by a Web.config file, users can still seethe files located in that directory if directory browsing is turned on and no other restrictions are in place.

← Older revision		Revision as of 02:51, 25 July 2013
Line 4:		Line 4:

	==Integrating Authentication with IIS==		==Integrating Authentication with IIS==
		+	[[File:Iis.png]]

	The authentication methods used in IIS 7 are the following:		The authentication methods used in IIS 7 are the following:

← Older revision		Revision as of 02:46, 25 July 2013
Line 1:		Line 1:
	= ASP.NET Security =		= ASP.NET Security =
		+
		+	Securing web applications in ASP.NET requires an integration of configurations between the .NET framework and IIS. ASP.NET applications contains a web.config file where you can define many access and privileges for example, but they alone are not sufficient to protect the resources of your application. IIS plays a major role in protecting the website’s assets contained in it too. It is important to understand the interaction between these components in order to implement proper security
		+
		+	==Integrating Authentication with IIS==
		+
		+	The authentication methods used in IIS 7 are the following:
		+	• Anonymous
		+	• ASP.NET impersonation
		+	• Basic
		+	• Client certificate mapping,
		+	• Digest
		+	• Forms
		+	• Windows Integrated Security (NTLM or Kerberos)
		+
		+	Enable and configure the necessary type of authentication based on the security level required by your application. ASP.NET membership and ASP.NET login controls implicitly work with forms authentication.
		+
		+	ASP.NET configuration works only for its resources. Keep in mind that if you need to configure access to resources of files contained in your application such as .txt, .gif, .jpg, these are done through the IIS permissions. For example, even though the ASP.NET resources in a directory might be forbidden by a Web.config file, users can still seethe files located in that directory if directory browsing is turned on and no other restrictions are in place.
		+
		+

	== Input validation ==		== Input validation ==

@@ Line 21: / Line 21: @@
 |}
-== Data Encryption ==
-== Authentication and Authorization==
 == Reference ==
 http://msdn.microsoft.com/en-us/library/bwd43d0x%28v=vs.85%29.aspx

@@ Line 20: / Line 20: @@
 | User-defined || CustomValidator  || Checks the user's entry using validation logic that you write yourself. This type of validation enables you to check for values derived at run time.
 |}
 == Data Encryption ==

@@ Line 1: / Line 1: @@
 = ASP.NET Security =
-== Input validation Input ==
+== Input validation ==
 Anything coming from external sources can be consider as input in a web application. Not only the user inserting data through a web form, but also data retrieved from a web service or database, also headers sent from the browsers fall under this concept. A way of defining when input is safe can be done through outlining a trust boundary.