Create an ASP. NET data storage layer (5)

Security issues of IIS, ASP. NET, and SQL Server
SQL Server, Internet Information Server, and ASP. NET engine all provide solid and reliable security models that can work together well. To ensure the security of user data and applications, Microsoft also sets a very low value for the default settings of each service. Most developers face the challenge of using SQL Server, IIS, and ASP.. NET sets an appropriate level of trust between applications and data, without leaving security vulnerabilities that can be easily attacked by others. Because three types of services (SQL Server, IIS, and ASP. NET) are involved, three key steps are required to ensure the security of the solution. This section describes a more common (and reliable) method for setting sufficient permissions and trust levels for Web applications.
Note: the topic of security and Web solutions cannot be fully discussed in this series of articles. For a better understanding of this problem and possible solutions, see the document series on creating patterns and practices for secure ASP. NET Applications: authentication, authorization, and secure communication.
Define DotNetKB to customize the IIS user account.
The safest way to ensure the security of Web applications is to define a Custom User with limited permissions and then configure IIS, this allows you to run your Web application as a Custom User. This is quite easy to implement and ensures that every visitor accessing your Web application has only the permissions you want them to have.
The first step is to generate a new Windows user (called DotNetKB in this example), set an enhanced password for it, and add it to the Windows Guest Group (Guest Windows Group. At the same time, make sure that the check boxes of Password never expires (password never expires) and User cannot change Password (the User cannot change the password) are selected. This will generate a user with limited permissions. When running your Web application in IIS, you can use it as an identifier (see figure 7 ).
Figure 7: users with limited Permissions
Then, call the Internet Information Server administrator and select the Web application that hosts these webpages. In this example, you can select the Web application (DotNetKB_WebSite) that hosts the test page generated above ). Right-click the Web application in the tree view, and select Properties... from the context menu ...). Select Directory Security and click the Edit button in the Anonymous access and authentication control (Anonymous access and authentication control) section of the dialog box. Finally, enter the user name (DotNetKB), deselect the Allow IIS to control password check box, and enter the password of the user account. Click OK to save the changes to the IIS configuration database (see figure 8 ).