Question

I’m using ASP.NET and rely on the web.config file to secure sections of my site. However, is this truly reliable, or is it also a good idea to add an IsAuthenticated check in the Page_Load event? Also, is it possible for someone to directly call methods (assuming they somehow got my method names and method signature) in my application’s DLL? For example, I have a method to add users to a specific group. Can an attacker somehow call that method through their own custom POST and execute it?
Thanks

Answer 1

If you are concerned about specific methods being executed without permission, I’d use code attribute security or your own roles check system to secure the method regardless of who’s calling it. I could imagine scenarios where even friendly developers call methods accidentally without making sure the code path has the right to perform privileged functions.