Security Issues with ASP.Net

Discussion in 'ASP .Net' started by Sanjay Poojari, Jul 21, 2003.

  1. Hi All,

    Need some advice on some of the security issues in my ASP.Net application.
    There are certain tasks that I need to implement so need advice/guidance on
    them as well as safeguards that I should implement. The application would
    be typically running on Windows Server 2003 with IIS6 with .Net framework
    1.1

    1. My application saves its settings to the registry. I know that by
    default the Aspnet user does not have rights to edit the registry. My
    Workaround is that I changed the user in processmodel from "machine" to
    "SYSTEM" in the machine.config file. Also in case of 2003 Server, I have to
    explicitly grant full rights to the aspnet user to the registry.

    Somehow I feel that this solution is not a good one and has the potential
    for making the web server unsafe. Any other solutions/workarounds for this
    problem?

    2. My application needs to read/write/create directories from the file
    system on the webserver. I have to explicitly grant the aspnet user full
    access to the directories in question. Any other elegant solution to this
    issue?

    Also, in Windows Server 2003, this does not work if the directory is located
    inside the "Program Files" directory. Does not work even when the aspnet
    user is added to the Administrators group. Why could this be happening?

    Any suggestions/pointers would be appreciated.

    Thanks in advance,
    Sanjay
     
    Sanjay Poojari, Jul 21, 2003
    #1
    1. Advertisements

  2. Most executable programs you run use the local System account to run.
    ASP.Net is no different. There is no Security risk unless some hostile
    person can somehow take control of your ASP.Net app. The aspnet user account
    is more useful if you are, for example, a hosting service, and of course,
    you don't want to grant blanket access to the entire machine to all of your
    hosting clients.
    --
    HTH,

    Kevin Spencer
    Microsoft MVP
    ..Net Developer
    http://www.takempis.com
    Big things are made up of
    lots of little things.
     
    Kevin Spencer, Jul 21, 2003
    #2
    1. Advertisements

  3. Thanks Kevin!

    Sanjay
     
    Sanjay Poojari, Jul 21, 2003
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.