1、英文文献 An Introductory Guide to Building and Deploying More Secure Sites with ASP.NET and IIS SUMMARY ASP.NET and Microsoft Internet Information Services (IIS) work together to make building secure Web sites a breeze. But to do it right, you have to know how the two interrelate and what options they p
2、rovide for securing access to a Web sites resources. This article, the first in a two-part series, explains the ABCs of Web security as seen through the eyes of ASP.NET and includes a hands-on tutorial demonstrating Windows authentication and ACL authorizations. A range of security measures and auth
3、entication methods are discussed, including basic authentication, digest authentication, and role-based security. Theres an old adage among developers that says building security into software is like paying taxes. You know its important and you know you must do it sooner or later, but you put it of
4、f as long as you can and when you finally do it, you do so only because you have to. You might not go to jail for building insecure applications, but security is no less important because of it. In many applicationsWeb applications in particularsecurity isnt a luxury； its a necessity. Security is a
5、big deal in network applications because by nature those applications are available to (and vulnerable to misuse by and attacks from) a larger population of users. When the network to which an application is deployed is the Internet, security becomes even more important because the list of potential
6、 users grows to about four billion. Web security is a broad and complicated subject. Much of the ongoing research in the field has to do with hardening Web servers against attacks. Microsoft Internet Information Services (IIS) administrators are all too aware of the past security holes in IIS and of
7、 several patches and security updates from Redmond. But this article isnt about protecting servers from buffer overruns and other hack attacks； rather, this article is about using ASP.NET to build secure sites that serve up pages only to authorized users. Most sites built with ASP.NET fall into one
8、of three categories:Sites whose content is freely available to everyone. Internet sites that serve the general population but require a login before displaying certain pages.eBay is a great example of such a site. Anyone can browse eBay and view the ongoing auctions, but when you place a bid, eBay r
9、equires a user name and password. eBay also has a feature named My eBay that lets you review the auctions youve bid on. Because My eBay pages are personalized for individual users and because they contain private information such as maximum bid prices, you must log in before viewing them. Intranet s
10、ites that expose content to a controlled population of usersfor example, a companys employeeswho have accounts in a Windows domain (or set of domains). Sometimes these sites support a limited degree of Internet access, too, so authorized users can access them from anywhere an Internet connection is
11、available. Sites that fall into the first category require no special protection beyond what the Web server provides. Sites in the second and third categories require some form of application-level security to identify authorized users and prevent illicit accesses. ASP.NET provides that application-
12、level security. It works in conjunction with IIS and the Windows security subsystem to provide a solid foundation for building secure sites. And it builds on what IIS has to offer to make deploying secure sites as easy as possible. This is the first in a two-part series on building secure Web sites
13、with ASP.NET. In this installment, youll learn how ASP.NET integrates with IIS and Windows and how the three can be combined to protect resources using Windows authentication and access control list (ACL) file authorizations. Part two of this article will cover ASP.NET forms authenticationa cool new
14、 feature of ASP.NET that lets you secure sites using a combination of form-based logins and URL resource authorizations. Understanding Web Security At the application level, Web security is first and foremost about securing pages so that they cant be retrieved by unauthorized usersfor example, preve
15、nting non-managers from viewing pages containing salary data and performance evaluations on the company intranet or preventing other people from viewing your My eBay pages. At a slightly deeper level, you might want to know who requested the page so you can personalize it for that individual. Either
16、 form of protection requires two overt actions on the part of the application: identify the originator of each request and define rules that govern who can access which pages. A Web server identifies callers using a mechanism called authentication. Once a caller is identified, authorization determin
17、es which pages that particular caller is allowed to view. ASP.NET supports a variety of authentication and authorization models. Understanding the options that are available to you and how they interrelate is an important first step in designing a site that restricts access to some or all of its res
18、ources or that personalizes content for individual users. Authentication Authentication enables the recipient of a request to ascertain the callers identity. The caller might claim to be Bob, but you dont know he really is Bob unless you authenticate him. ASP.NET supports three types of authenticati
19、on: Windows authentication, Passport authentication, and forms authentication. When Windows authentication is selected, ASP.NET looks to IIS for help. IIS does the hard part by authenticating the caller. Then it makes the callers identity available to ASP.NET. Lets say Windows authentication is enab
20、led and Bob requests an ASPX file. IIS authenticates Bob and forwards the request to ASP.NET along with an access token identifying Bob. ASP.NET uses the token to make sure Bob has permission to retrieve the page he requested. ASP.NET also makes the token available to the application that handles th
21、e request so that at its discretion, the application can impersonate Bobthat is, temporarily assume Bobs identityto prevent code executed within the request from accessing resources that Bob lacks permission to access. For Web applications, Windows authentication is typically used in the following scenarios: Your application is deployed on the companys intranet and everyone who uses it has an account that they can use to log in and access network resources.
