Design of the Security Application Block

Retired Content

This content is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these technologies. This page may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

The latest Enterprise Library information can be found at the Enterprise Library site.

The Security Application Block addresses the following areas:

  • Authorization
  • Security-related caching

Design Goals

The application block is designed to achieve the following goals:

  • Provide a simple and intuitive interface to the commonly required authorization functionality.
  • Encapsulate the logic used to perform authorization and security-related caching.
  • Present a standard provider model for authorization and security-related caching.
  • Ensure that the application block is extensible.
  • Ensure that there is minimal or negligible performance impact compared to security code that access the .NET Framework classes directly to accomplish the same functionality.
  • Incorporate best practices for application security, as described in Improving Web Application Security: Threats and Countermeasures.

Design Highlights

The Security Application Block is designed to externalize the implementation of the authorization and caching provider from a running application. This design lets you change implementations without changing the code of the application. Figure 1 illustrates the interrelationship between the key classes in the Security Application Block.


Figure 1
Design of the Security Application Block