Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 441
  • Last Modified:

Securing a web application.

Hello,

I have written a little ISAPI dll that reads a document database and returns a document as a PDF by setting the reponse stream to the document.

It is very simple and works fantastically.

However i need to secure it so that not everyone can just type in the url and read a document.

Any suggestions?
0
soozh
Asked:
soozh
3 Solutions
 
Ray PaseurCommented:
The general design for client authentication is given in this article.  If you're not using PHP, choose the language you like and make a Google search for "[language] client authentication."  A good answer will almost certainly appear in the top one or two pages of search results.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391.html
0
 
btanExec ConsultantCommented:
Probably I see it as defense in depth where you harden from network, web and down to data layer. In this case, server hardening is good start like use of iis  and urlscan http://technet.microsoft.com/en-us/library/cc731278(v=ws.10).aspx

Check out url authorization and restrict of isapi
 http://technet.microsoft.com/en-us/library/cc772206(v=ws.10).aspx
 http://technet.microsoft.com/en-us/library/cc730912(v=ws.10).aspx

Overall, owasp cheatsheets are good resource to leverage further hardening of the web codes e.g. defense against force browsing and i see data leakage as a key concerned as well
 https://www.owasp.org/index.php/Cheat_Sheets
0
 
shalomcCTOCommented:
You can secure it by basic authentication in IIS.
The actual implementation depends on your environment (AD/domain/IIS version), here is how it is done in IIS 6.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/abbca505-6f63-4267-aac1-1ea89d861eb4.mspx?mfr=true
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now