ASP.NET 2.0 Security Best Practices (and the declarative PrincipalPermission attribute)
This is a great MSDN whitepaper about ASP.NET 2.0 Security Best Practices. I’d definitely recommend setting aside some time to read it. At the bottom of the whitepaper there are then links to another 28 additional ASP.NET HowTo security whitepapers. Most of the articles were rated a perfect 9 out of 9 from people who have read them – always a good sign of great content.
One tip that the papers cover that I’ve been meaning to blog about is the ability to add declarative permission attributes to classes and methods. These allow you to limit the ability to instantiate a type or invoke a class member based on the identity of the browser user for the request, and provide a clean defense-in-depth mechanism that you can use to add additional security to your business logic, data logic, and even UI logic within your page.
For example, the below code will prevent the “Authors” class from being instantiated during a request unless the incoming user is authenticated:
[PrincipalPermission(SecurityAction.Demand, Authenticated=true)]
public class Authors
{
// Methods
}
And the below code will prevent the "Authors" class from being instantiated during a request unless the incoming user is in the “Admin” role:
[PrincipalPermission(SecurityAction.Demand, Role="Admin")]
public class Authors
{
// Methods
}
Note that enabling role-based security with ASP.NET 2.0 is now trivially easy with the new ASP.NET 2.0 role management service. Here is one of those how-to articles on how to use the new role-manager capabilities.
Hope this helps,
Scott