لطفا منتظر باشید ...
Chapter 2: Authenticating and Authorizing Users
Introduction
The real test of a secure Web application occurs when it comes time for users to log in and access your site. At first the process seems simple: provide the user with a login screen and let the user enter, if he or she supplies the correct username and password. But Web security can fail in many ways. In this chapter, we will discuss those failures and solutions to prevent them.
Authentication establishes a user’s identity. Once this identity is proved valid, the user is authorized (or not authorized) to access various features of the Web application. ASP.NET has many advantages over classic ASP because it provides a much more robust authentication mechanism as well as tools to implement advanced authentication and authorization scenarios.
But with all the new authentication and authorization features of ASP.NET, programmers are still prone to making many of the same errors they did with past versions of ASP. This chapter focuses on the authentication and authorization portion of a Web application.
Understanding the Threats
The primary threats with user authentication are:
Account hijacking This involves taking over the account of a legitimate user, sometimes denying the rightful user access to his or her account.
Man-in-the-middle Intercepting Web traffic in such a way that the attacker is able to read and modify data in transit between two systems.
Phishing A type of man-in-the-middle attack in which the attacker lures a legitimate user to enter a password through a fake e-mail or Web form designed to look like that of a legitimate Web site.
Unauthorized access Gaining access to restricted content or data without the consent of the content owner.
Information leakage Revealing or failing to protect information that an attacker can use to compromise a system.
Privilege escalation Allowing an attacker to gain the access privileges of a higher-level account.
Sniffing Using a network-monitoring utility to intercept passwords or other sensitive information that traverses a network.
