ASP.NET 2.0 Security Best Practices (and the declarative PrincipalPermission attribute)
This is a great MSDN whitepaper
about ASP.NET 2.0 Security Best Practices. I’d definitely recommend setting aside some time to read
it. At the bottom
of the whitepaper there are then links to another 28
additional ASP.NET HowTo security whitepapers. Most of the articles were rated a perfect 9 out of 9 from
people who have read them – always a good sign of great
content.
One tip that the papers cover that I’ve been meaning to
blog about is the ability to add declarative permission
attributes to classes and methods. These allow you to limit the ability to instantiate a
type or invoke a class member based on the identity of the
browser user for the request, and provide a clean
defense-in-depth mechanism that you can use to add
additional security to your business logic, data logic,
and even UI logic within your page.
For example, the below code will prevent the “Authors” class from being instantiated during a request unless the incoming user is authenticated:
[PrincipalPermission(SecurityAction.Demand, Authenticated=true)]
public class Authors
{
// Methods
}
And the below code will prevent the "Authors" class from
being instantiated during a request unless the incoming
user is in the “Admin” role:
[PrincipalPermission(SecurityAction.Demand,
Role="Admin")]
public class Authors
{
// Methods
}
Note that enabling role-based security with ASP.NET 2.0
is now trivially easy with the new ASP.NET 2.0 role
management service. Here is one of those how-to articles
on how to use the new role-manager capabilities.
Hope this helps,
Scott