Solved

Securing a web application.

Posted on 2012-03-23
3
423 Views
Last Modified: 2012-06-21
Hello,

I have written a little ISAPI dll that reads a document database and returns a document as a PDF by setting the reponse stream to the document.

It is very simple and works fantastically.

However i need to secure it so that not everyone can just type in the url and read a document.

Any suggestions?
0
Comment
Question by:soozh
3 Comments
 
LVL 109

Assisted Solution

by:Ray Paseur
Ray Paseur earned 167 total points
ID: 37761409
The general design for client authentication is given in this article.  If you're not using PHP, choose the language you like and make a Google search for "[language] client authentication."  A good answer will almost certainly appear in the top one or two pages of search results.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391.html
0
 
LVL 62

Assisted Solution

by:btan
btan earned 166 total points
ID: 37761886
Probably I see it as defense in depth where you harden from network, web and down to data layer. In this case, server hardening is good start like use of iis  and urlscan http://technet.microsoft.com/en-us/library/cc731278(v=ws.10).aspx

Check out url authorization and restrict of isapi
 http://technet.microsoft.com/en-us/library/cc772206(v=ws.10).aspx
 http://technet.microsoft.com/en-us/library/cc730912(v=ws.10).aspx

Overall, owasp cheatsheets are good resource to leverage further hardening of the web codes e.g. defense against force browsing and i see data leakage as a key concerned as well
 https://www.owasp.org/index.php/Cheat_Sheets
0
 
LVL 33

Accepted Solution

by:
shalomc earned 167 total points
ID: 37761919
You can secure it by basic authentication in IIS.
The actual implementation depends on your environment (AD/domain/IIS version), here is how it is done in IIS 6.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/abbca505-6f63-4267-aac1-1ea89d861eb4.mspx?mfr=true
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

The new Gmail Phishing Scam going around is surprising even the savviest of users with its sophisticated techniques.
FAQ pages provide a simple way for you to supply and for customers to find answers to the most common questions about your company. Here are six reasons why your company website should have a FAQ page
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question