Re: doubt on Web.config

[mahendra]

New Message on dotNET User Group Hyd doubt on Web.config Reply   Reply to Sender   Recommend Message 4 in Discussion From: mahendra you have the option of restricting the config file to display in browser. By default it is restricted , check it in machine.config in Http handlers config - Forbidden handler ----- Original Message ----- From: "Bhavin_Mandan" <[EMAIL PROTECTED]> To: "dotNET User Group Hyd" <dotNETUserGroupHyd@groups.msn.com> Sent: Tuesday, May 03, 2005 6:13 PM Subject: Re: doubt on Web.config New Message on dotNET User Group Hyd doubt on Web.config Reply Reply to Sender Recommend Message 3 in Discussion From: Bhavin_Mandan The web.config file of any application is obviously an xml file, and any xml file can be simply displayed in a browser, but it is never displayed to any user on request !!<o:p></o:p> <o:p> </o:p> The web.config file contains very crucial information about the application<o:p></o:p> <o:p> </o:p> The most crucial aspects that should be very confidential and should be secured from the outside world are<o:p></o:p> <o:p> </o:p> 1.. <Authentication> and <Authorization> modules of the web.config file contain the mode of authentication and the list of users to be allowed or denied access. The windows usernames and password (in plain text) are written in these modules. This should be strictly secured from anonymous users<o:p></o:p> <o:p> </o:p> 2.. The <appSettings> module contains many important and crucial key/ value pairs that must be secured.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> 3.. When ASP.NET is used along with enterprise servers (like MCMS or Commerce Server), some additional tags are added in the web.config file, that contain details of security features.<o:p></o:p> <o:p> </o:p> So, it is highly unadvisable and dangerous from a security perspective to share web.config file to anonymous users<o:p></o:p> <o:p> </o:p> Regards,<o:p></o:p> Bhavin Mandan <o:p></o:p> View other groups in this category. Also on MSN: Start Chatting | Listen to Music | House & Home | Try Online Dating | Daily Horoscopes To stop getting this e-mail, or change how often it arrives, go to your E-mail Settings. Need help? If you've forgotten your password, please go to Passport Member Services. For other questions or feedback, go to our Contact Us page. If you do not want to receive future e-mail from this MSN group, or if you received this message by mistake, please click the "Remove" link below. On the pre-addressed e-mail message that opens, simply click "Send". Your e-mail address will be deleted from this group's mailing list. Remove my e-mail address from dotNET User Group Hyd. View other groups in this category. Also on MSN: Start Chatting | Listen to Music | House & Home | Try Online Dating | Daily Horoscopes To stop getting this e-mail, or change how often it arrives, go to your E-mail Settings. Need help? If you've forgotten your password, please go to Passport Member Services. For other questions or feedback, go to our Contact Us page. If you do not want to receive future e-mail from this MSN group, or if you received this message by mistake, please click the "Remove" link below. On the pre-addressed e-mail message that opens, simply click "Send". Your e-mail address will be deleted from this group's mailing list. Remove my e-mail address from dotNET User Group Hyd.