Summary

[Previous] [Next]

Authentication and authorization are mandatory processes for any secure Web application, and it's commonplace to use alternate security techniques such as cookies or forms to achieve Web-based solutions. However, you should always leverage the operating system's capabilities wherever possible. Failure to do so can lead to vulnerabilities that might be exploited by attackers.

This chapter discussed some ways you can perform your own authentication and authorization by using cryptographic means. If you decide to develop your own security mechanisms, be sure to protect your COM+ and database servers from attack and seriously consider not storing user's passwords in the database. In a world where privacy issues are becoming daily headline news, it's imperative that you take steps to protect your clients. Not only is the protection of communication between the client and your Web server important, but the data you hold about your clients must also be protected from attack. Privacy and its associated topics are the subject of the next chapter.