Certificates and SSL are discussed as they relate to Microsoft products, providing a basic understanding of how to set up their use. This chapter begins with a look at IE and its security levels and zones, and its Administration Kit for sitewide configuration. Methods of deriving client information for profiling and other uses are discussed, along with ways to avoid them. The latter half of the chapter covers the differences between Java Applets and ActiveX controls and how Microsoft tries to make ActiveX developers accountable for their code. This chapter provides a very basic, high-level look at Active Server Pages and some of its features, most particularly the way in which it implements Sessions.
Session hijacking is discussed briefly.
This chapter focuses on detailed security topics. First, it covers how to force the user to authenticate by sending the appropriate headers to their browser. It then authenticates the user using a text file and base64 encryption. Some pretty advanced coding techniques are described, with complete source code, and a sample application of an ASP user registration and profiling application is explained and the source code listed. Microsoft Certificate Server A very thorough chapter on Microsoft Certificate Server and certificate protocols in general.