.NET Framework Security

Implementing a Secure Web Site

At this point, the site is designed, the security fundamentals—such as SSL, authentication, and authorization—are established, and everything has been tested. Now it's time to go over what is involved in implementing the secure Web site. Some of the items in the following paragraphs might seem to be a review of the steps that were completed previously, but in this section we will be discussing these items on a more global level.

First and foremost, implement the certificate to enable SSL. Then configure IIS to force SSL on the directory in which your application resides. Also, note that in the web.config file, you can make an entry for impersonation to be on by default. To increase security, it is recommended that ...