tailieunhanh - Building Secure ASP.NET Applications phần 7

Kích hoạt tính năng kiểm tra thành phần cấp độ truy cập. Để kích hoạt tính năng kiểm tra truy cập thành phần, sử dụng ComponentAccessControl lớp cấp thuộc tính như hình dưới trọng: Không thiết lập các kết quả này thuộc tính truy cập không kiểm tra được thực hiện | 322 Building Secure Applications For added security you can add code to encrypt the construction string prior to storage and decrypt it within the serviced component. More Information For more information on using connection strings see article Q271284 HOWTO Access COM Object Constructor String in a VB Component in the Microsoft Knowledge Base. For a complete code sample provided by the .NET Framework SDK see the object constructor sample located in Program Files Microsoft Visual Studio .NET FrameworkSDK Samples Technologies ComponentServices ObjectConstruction. Authenticating Users Against a Database If you are building an application that needs to validate user credentials against a database store consider the following points Store one-way password hashes with a random salt value . Avoid SQL injection when validating user credentials. Store One-way Password Hashes with Salt Web applications that use Forms authentication often need to store user credentials including passwords in a database. For security reasons you should not store passwords clear text or encrypted in the database. You should avoid storing encrypted passwords because it raises key management issues you can secure the password with encryption but you then have to consider how to store the encryption key. If the key becomes compromised an attacker can decrypt all the passwords within your data store. The preferred approach is to Store a one way hash of the password. Re-compute the hash when the password needs to be validated. Combine the password hash with a salt value a cryptographically strong random number . By combining the salt with the password hash you mitigate the threat associated with dictionary attacks. Creating a Salt Value The following code shows how to generate a salt value by using random number generation functionality provided by the RNGCryptoServiceProvider class within the namespace. Chapter 12 Data Access Security 323 public static string .