Professional ASP. NET security - Russ Basiura

This title seeks to show you how to make effective use of the security framework provided by ASP.NET. It covers the key technologies for authentication (identifying users) and authorization (controlling access to recources). It also shows how to use other ASP.NET features to keep applications secure.;ASP.NET provides a flexible and extensible authentication framework. This title presents the built in options for authentication, discussing when they should be used and showing how they should be applied for maximum security. For those who have needs beyond what the standard authentication methods provide, it shows how to extend and enhance them to create custom security systems. Authorization is covered in depth. How to use the built in authorization system to control access to the resources that a web application exposes is shown. Things are then taken further by showing how to extend the system to address more advanced authorization scenarios.;Good configuration is vital if our applications are to be secure. This title explains how to configure IIS and ASP.NET so that they work together to provide good security.;Even with a good authentication and authorization system, there are still many ways in which a web application can be attacked. This title shows how we can code ASP.NET applications to avoid the most common vulnerabilities.;Code Access Security, a good way to restrict what operations code can perform, is introduced with examples that show how it can be applied. Most of the techniques presented in the rest of the book apply just as well to web services as to browser based web applications. Additional techniques particular to web services are also discussed.