Gateway Accessory

Abstract:

Gateway accessory 4 is an e-commerce web application that allows customers to

browse and purchase pets. It has the following functionality:

• View products by category

• View products details
• Search for products by keyword
• Add/Remove/Edit items in a shopping cart
• Add/Remove items in a wish list
• Transfer a wish list to a shopping cart
• Register as a user
• Edit user profile
• Login and logout
• Checkout and purchase product

The Microsoft .NET Pet Shop 2.0 illustrates basic and advanced coding concepts
within an overall architectural framework that can be applied in Web-based
application development projects. The application highlights coding techniques
for building n-tier applications that can be deployed on clusters of load-balanced
servers or on a single server. The application illustrates such basic concepts as
middle-tier data caching, middle-tier session-state management, distributed
transactions involving .NET/COM+ serviced components, and building a Web
service facade to expose application logic for XML/SOAP-based integration with
other applications.

A brief Security Objectives exercise on Pet Shop 4 revealed the

following key security requirements:

1. Anonymous users should be able to browse but not purchase products

2. Anonymous or authenticated users should not be able to view or modify
the contents of another user’s shopping cart
 3. Anonymous or authenticated users should not be able to view or modify
the contents of another user’s wish list
4. Product pricing and other product details, should not be modified by any
users
5. Authenticated user credentials should be protected from disclosure and
tampering
6. Shopping cart contents should be protected from disclosure and
tampering
7. Wish list contents should be protected from disclosure and tampering
8. Credit card information should be protected from disclosure and
tampering
9. Customer profile data should be protected from disclosure and tampering
10. Sensitive data stored in database including item inventory and orders
should be protected from disclosure and tampering
11. Sensitive data including credit card info, inventory, orders in transit
should be protected from disclosure or tampering.

All of the security requirements are met by the Pet Shop 4 security
reference implementation that is a companion to this document.

System Specifications:
• Operating System : Windows XP Professional SP2
• Processor : Pentium 4.0(1.6GHz)
• Memory : 512 MB

Technologies Used:
• Web-technologies : ASP.NET
• Frameworks : .NET Framework 2.0
• Database : SQL Server 2000
• Web server : IIS 5.0