Authentication: Secure Asp. Net

This updated guide examines Authentication: Secure Asp. Net and organizes the essential facts, background, and practical takeaways in clear American English.

In this chapter, we will discuss some methods to help ensure safety for ASP. NET applications. To emphasize the central content of the chapter, we will not discuss network security, server security and ASP. NET infrastructure security. Saying that does not mean that the topics are not important. On the contrary, if you do not configure appropriate security support for the server and network infrastructure, what is trying to do to ensure the security of ASP. NET applications through the. NET Framework tools provided. will become useless. However, within the limits of a chapter, we only go into the security of ASP. NET application programs.

The importance of security has no word at all. Failure to invest the appropriate time and resources for this task can lead to undesirable outcomes such as data loss, misplaced application or application execution and reduced sales. collect profits of businesses, making businesses lose credibility with customers. It is also important to consider security issues right from the start of building applications.

Ensuring safety in application access or resource access of the application focuses on two processes: authentication (authorization) and authorization . We will be interested in the three authentication methods provided by the ASP. NET runtime: Windows, Form and Passport . As for licensing, we will discuss mainly about two mechanisms: using the URL path and using the access control list ACL .

9.1.Appraisal methods

Authentication is the process of identifying the requested person or program. It does not assign resource access (the function of the licensing mechanism) but checks the known identifier to decide whether to accept this request or not. Simply put, the assessment answers the question: 'Who are you?'

In the classic ASP application, there are two main authentication methods: one is IIS-based to authenticate users under a Windows account, then use the NT access control lists (ACLs) to complete the process. expertise; The second is to provide a specific type of authentication, compare to match user credentials stored on the server (possibly in Microsoft Active Directory). Each method has its own limitations. The safest model of Windows, Integrated Security authentication, requires all users to use Internet Explorer and not work with too many proxy servers. Private auditing requires building and testing a large amount of work on your own.

ASP. NET provides three authentication mechanisms:

Verify Windows Provide similar functionality to IIS authentication in classic ASP, but there are also some important differences. Windows authentication works with the built-in IIS authentication and uses the identity provided by IIS authentication to perform the authentication process.

Forms appraisal Mainly used for own authentication mechanism. Forms authentication supports a generic login page, providing many options for storing credentials, from databases with XML format, configuration files, and a number of help methods for managing authentication activities. determined. This authentication mechanism is mostly used for Internet-related cases.

Passport appraisal Allows ASP. NET developers to use advanced techniques in Microsoft's Passport application login solution.

The authentication mechanism for ASP. NET is usually configured at the machine level, using the file machine.config or application level, using the web.config file. We can configure authentication settings using elements with its attributes and child elements.

Authentication settings are not allowed to be configured below the application level. That is, if you want to apply the authentication policy to a sub-directory of an application, we need to configure it as an application in IIS. Authorization settings do not have this limitation.

9.1.1.Verify Windows

As mentioned earlier, Windows authentication has the same functionality as IIS authentication in classic ASP. Verify IIS uses user account information stored on the local server or Domain Controller and injects the user identity into the ASP. NET runtime to use for authentication. The main reason for choosing Windows authentication is because it needs the lowest amount of deployment code. Of the three ASP. NET authentication mechanisms provided, only Windows authentication requires configuring IIS for authentication settings in the machine.config or web.config file.

Like IIS authentication in ASP, Windows authentication is primarily used in the following cases:

• All clients use Internet Explorer 4.0 or higher and do not have too many proxy servers, mostly popular in Intranet networks, which are not common in Internet applications.
• Security requirements in the application are low, requiring only Basic or Digest IIS authentication (both have limitations that are less secure than unified security).
• Security requirements do not allow anonymous users to access the entire application.

Windows authentication is primarily used in conjunction with impersonation (ie a specific security context). We can restrict resource access by using the NTFS Access Control List (NTFS ACL) or assigning database access to each user's Windows account when logging into the database..

Windows authentication works on the principle of using the user's security context removed from IIS. The first step in configuring an application to use Windows authentication is to change IIS configuration settings so that it meets one of the non-anonymous authentication methods. We can do the following:

1. Open Internet Services Manager .
2. In the left pane, point down to the virtual website or root directory you want to configure.
3. Right-click the folder you want to configure and select Properties to display the properties dialog box.
4. Click theDirectory Securitytab, then theEditbutton under 'Anonymous access and authentication control'.
5. Uncheck the 'Anonymous access' checkbox and select one or more authentication mechanisms (Basic, Digest, Integrated Windows).
6. ClickOKto close the authentication method dialog box, then click OK again to close the Properties dialog box. Now we are qualified to configure the ASP. NET application.

There are three levels of Windows authentication: Basic, Digest and Integrated. In which Windows Basic authentication is the most basic level. It allows the use of Windows accounts in more cases but username and password information is sent in plain text. This is an extremely dangerous point, especially when the application does not use Secure Sockets Layer (SSL) encryption to protect communication activities. Selecting Basic level usually has more risks than other levels.

Similarly, the Digest level requires that the password must be stored in plain text on the Domain Controller, which contains the accounts. When using Digest authentication, we must be careful about network attacks on Domain Controllers and must be physically secure before unauthorized intrusion groups can access to steal password information.

Figure 9.1: Windows authentication process

As shown in the diagram, the Windows authentication process sequence starts when the client sends a request to the server. IIS will verify the information on the client, then bring the request to the ASP. NET runtime, including the security context, ASP. NET uses security context, examines elements such as ACL. and meet the client's requirements.

In order for ASP. NET to use the security context provided by IIS, the ASP. NET application must be configured for Windows authentication. This configuration is done by adding the element to the web.config file of the application and setting the mode attribute to Windows, which can be written as follows:

Since the element does not require any child elements for the Windows model, we can use a single tag with a closing sign '/' instead of a full closing tag.

9.1.1.1 Impersonation

Impersonation is the practice of source code running in the security context of a specific account. In ASP. NET, impersonation is used to allow application code to be executed in a specific security context of an authenticated user.

By default, the ASP. NET executable program runs in the context of a special account called ASPNET. This account has very few privileges. So the resource requests protected by the Access Control List (ACL) (such as the file in the file system) will fail, unless the ASPNET account is explicitly granted privileges. This mechanism makes ASP. NET applications more secure.

When assigning explicit privileges to an ASPNET account, the account will have a high priority, allowing multiple types of requests to be successfully executed without using impersonation . For example, the default SQL Server allows access to any user in the local administrator group to run the executable ASP. NET as SYSTEM, making it possible to connect to a database. Whether the local SQL Server uses a trusted connection without using impersonation.

Running the system as SYSTEM can solve some privilege issues but not a good idea. Because it provides more privileges than is necessary for most ASP. NET applications. At that time, any vulnerabilities can appear in IIS or the ASP. NET runtime can provide system-level access to those who exploit them, whether legal or unauthorized. Running the ASP. NET executable using an ASPNET account significantly reduces threats such as a vulnerability exploit.

(This setting is controlled by the username attribute of the element in machine.config) .

In most cases of Windows authentication, impersonation is used to allow the ASP. NET runtime to respond to a request (taking into account security context) for an authenticated user. In classic ASP, impersonation is used by default. We can enable impersonation in ASP. NET by adding the element to the web.config file of the application, the impersonate attribute must be set to True , as the code below:

After impersonation is allowed, we can use NTFS ACL (NTFS access control list) to verify the account for resource access requests.

9.1.2 Forms authentication

Forms authentication is considered the most useful method of the three ASP. NET methods provided. It provides a very flexible infrastructure for user-defined security contexts. When an application is configured to use Forms authentication, requests for protected resources are redirected to a specific login page, except for the request with an authentication token included in a cookie.

9.1.2.1. Login (Log in)

On the login page, the website developer will write a code to verify the authentication information entered by the user to see if it matches the backup information in the server storage area. This storage area can be a relational database such as SQL Sever, an XML file, Microsoft Active Directory or any other storage location we choose. If the user information sent matches the information stored on the server, the runtime will call the RedirectFromLoginPage method of the FormsAuthentication helper to send back to the site user they requested with a temporary cookie or a cookie. long-term authentication token on the user's machine. Once the user has been authenticated, they have access to other areas of the application without logging in again.

To better illustrate the process of Form authentication, let's take an example.

The example uses the following files:

web.config Configuration file, used to enable Forms authentication mechanism and describe the desired access limit.

Login.aspx The application's login page, which receives the user's credentials and, if that information is valid, redirects the user to the requested URL.

Register.aspx Application registration page. Allow unregistered users to choose authentication information to access the application.

Logout.aspx Wipe out all Form authentication cookies, actually taking users out of the secure area of the application.

Users.xml XML file, containing authentication information of registered users. Passwords are stored as SHA1 hash function strings.

To use Form authentication, the application must be configured with the web.config file as shown in Figure 9-1, located at the root of the application.

Example 9-1: Web.config file for Form authentication

The element in Listing 9-1 configures applications that use Forms authentication. Its children,, provide some basic security elements: a name for cookie authentication Forms (. ASPNETIAN), protection type (encryption, validation, all or nothing) for cookies evaluation, cookie time round (for example here is 60 seconds, default is 30 seconds) and a login page for users who are not authenticated. Note that in the example we use Login.aspx file, so by default we will ignore this attribute.

(In version v1.1 of the. NET Framework, two new properties of the element added are RequireSsl and SlidingExpiration).

The element, tied to the files subdirectory by using tags, denies access to any anonymous users.

With the appropriate configuration, if the user does not have an authentication cookie, the request to any file in the files subdirectory (thought to be controlled by ASP. NET) will also take the user to the login page. But what happens when the file type you want to protect is not controlled by ASP. NET by default? Then, we can perform the following steps to add the file type to the IIS configuration for the application:

1. Open theInternet Services Managerand locate the file you want to configure.
2. Right-click on the file's icon and selectProperties.
3. In thePropertiesdialog box, select theDirectorytab (orHome Directory) and click theConfigurationbutton.
4. On theApp Mappings tab, click theAddbutton.
5. In theAdd / Edit Application Extension Mappingdialog box, click theBrowsebutton and create the path to the folder location aspnet_isapi.dll . Usually this location has the form % windir% Microsoft. NETFramework% version% , where % version% is the. NET Framework version. Maybe we will need to change the Files attribute of type from drop-down to *.dll. Then click to select the file and click Open.
6. Now enter the file extension name (such as .zip ) or enter. * To attach all supported file types in ASP. NET.
7. ClickOKto save the changes and close each dialog box.
8. Repeat steps if you want to add another type of file.

Note: Using the . * Character to map all file types contained in ASP. NET is a quick and easy way to protect all of these file types in applications that use Forms authentication. However, we should not use this technique if the application contains many files, like classic ASP pages controlled by another ISAPI application. Because. * Will give priority and make these file types not work as expected.

After all file types have been included in the ASP. NET driver, any requests given to one of those file types in the subfolder will cause the user to be redirected to the Login.aspx file. If they do not yet have a Forms authentication cookie for this application. The code for Login.aspx is illustrated in Listing 9-2 below:

Example 9-2. Login.aspx

<% @ Page Language = "VB"%><% @ Import Namespace = "System.Data"%><% @ Import Namespace = "System.Web.Security"%>Login Page Email: Password: Persist Authentication Cookie?

The tag section of Login.aspx is quite easy to understand, including textboxes to enter the e-mail address (username and password). There is also a checkbox that allows users to continue using the authentication cookie (so they won't need to log back in from their machine).

To make the code a bit easier to read, in the example there is an @ Import directive for both System. Data and System. Web. Security namespaces. Therefore, we can access the members within them without using the namespace prefix.

In the Login_Click event handler, you declare a local DataSet variable and include it in the cache of the ASP. NET or Users.xml file containing the credentials of the registered user. If the dataset is retrieved from the XML file, we can insert it into the cache to retrieve later (except to have to read the file if it changes anything).

Calling Cache. Insert sets a file dependency on the Users.xml file. If the file changes, the cached dataset will be taken out and the new data will be added to the file in the next log-in request. This allows us to exploit the advanced features of executing caching, but still ensure processing with new data.

After we have a dataset containing all the current users, we need to make sure the user-entered email is in a table, using the Select method of the DataTable:

If LoginDS. Tables (0). Select ("Email = '" & _ Email.text & "'"). Length> 0 Then

If the e-mail exists, we have a DataRow containing the authentication information associated with that user. It is then possible to compare the password according to the hash function in the dataset with a copy of it entered by the user, which is the output of the HashPasswordForStoringInConfigFile method in the FormsAuthentication class (using the HashPasswordForStoringInConfigFile method ie you have never saved it). Store a real password, enabling the application to be less compromised). If the two passwords match, we will redirect the user back to the page they requested by calling the RedirectFromLoginPage function of the FormsAuthentication class. RedirectFromLoginPage will automatically bring the user back to the page described by the ReturnUrl query string parameter. This parameter is automatically added to the end when the user is returned to the Login.aspx file. RedirectFromLoginPage also sets a. ASNETIAN cookie containing Forms authentication token. The following code snippet illustrates this process:

Dim LoginRow () As DataRow = LoginDS. Tables (0). Select ("Email = '" _ & Email.text & "'") If LoginRow (0). Item ("Password"). ToString = _ FormsAuthentication. HashPasswordForStoringInConfigFile (_ Password. Text, "SHA1") Then FormsAuthentication. RedirectFromLoginPage (Email. Text, _ Persist. Checked) Else Message. Text = "Incorrect Password!" End If

If the e-mail address exists but the password is incorrect, we will set the Text property of the Message Label control to notify the user. If the e-mail address does not exist, we will create a message containing a link to the registration page for users to register themselves. The link must include a query string parameter named page that Register.aspx uses to convert the user back to Login.aspx with the ReturnUrl query string parameter. The registration part is controlled by the Register.aspx page, as illustrated in Figure 9-3.

Example 9-3. Register.aspx

<% @ Page Language = "VB"%><% @ Import Namespace = "System.Data"%><% @ Import Namespace = "System.Web.Security"%>Registration Page Email: Desired Password: Confirm Password:

The tag section of Register.aspx is similar to Login.aspx , except that there is one more textbox (to verify the password) and three validation controls:

• A CompareValidator control to determine if the value in the Password and PasswordConfirm boxes matches.
• A RequiredFieldValidator control to confirm that the user has entered the e-mail address, so we have no value for null e-mail in the XML file.
• A RequiredFieldValidator control to ensure that the user has entered a password to not have a null password value in the XML file.

If you want to ensure that additional e-mail is valid, we can use the RegularExpressionValidator function.

In the Register_Click event handler, it first checks to make sure the site is valid to help the processor avoid wasting time working with invalid data. If the user's browser supports DHTML, the site will not even be uploaded until the valid control requirements are met.

If the site is valid, a local DataSet variable will be declared and allocated memory space on the Users.xml file. Then check whether the e-mail address the user has entered exists on the file. If not, the Text attribute of the ASP. NET Label control will be used to ask the user to enter another e-mail address.

If the e-mail does not exist, a new DataRow will be created, containing the user's selected e-mail address along with the hash of the password, adding new rows to the dataset and writing the dataset back to the XML file (such as the wallet example below). This technique does not control polymerization, so if someone changes the contents of the XML file while it is being read or written to, the changes will be overwritten.

Dim NewUser As DataRow NewUser = LoginDS. Tables (0). NewRow () NewUser ("Email") = Email. Text NewUser ("Password") = _ FormsAuthentication. HashPasswordForStoringInConfigFile (_ Password. Text, "SHA1") LoginDS. Tables (0). Rows. Add (NewUser) LoginDS. WriteXml (Server. MapPath ("Users.xml"))

Note: To successfully write the file Users.xml, the account under the running ASP. NET runtime must access the file.

After writing the new user's information in Users.xml , we will bring the user to the description page in the query string parameter:

Response. Redirect (Request. QueryString ("Page"))

9.1.2.2. Exit (Log-out)

Sometimes we have to work with sensitive information in the application from public machines. In such cases, we need to provide users with some way to log out to prevent others from accessing private information or accessing application resources through their accounts. In authentication Forms this is quite simple. We can call the static method SignOut of the FormsAuthentication class as shown in Listing 9-4. The user will then be redirected to the Logout.aspx file to complete the log-out process. We can also create a user control that contains a button that, when clicked, will call the SignOut method and add user controls to all protected pages of the application.

Example 9-4. Logout.aspx

<% @ Page Language = "VB"%><% @ Import Namespace = "System.Web.Security"%>Logout Page

Listing 9-5 shows the contents of the Users.xml file.

Example 9-5. Users.xml

andrew@aspnetian.com 816010E041FA485C6E2383C649343D3A0CAD4D25

9.1.3.Passport appraisal

Passport authentication allows a user to have a unique password while being able to log in (e-mail addresses are attached to their Passport account) to multiple applications or websites. This simplifies the user login process and reduces administrative work when maintaining user accounts.

To use Passport authentication in ASP. NET we must download and install the Passport SDK.

After installing the SDK Passport, we need to configure according to the corresponding structure. Finally, configure the ASP. NET application to use Passport authentication, like the code below:

The redirectUrl element and attribute are optional and are used to describe an internal URL to redirect if a user requests a login without using their Passport account. If ignored, users who log in without using a Passport account will be redirected to the login page on a Passport login server.

9.2.Licensing (Authorization)

Licensing is the process of determining whether the user has been identified in the authentication process that is allowed to access the resource they are requesting or do any other action (eg update the database The database is then accessed.) Quá trình th?m ??nh tr? l?i cho câu h?i: 'B?n là ai?', còn quá trình c?p phép tr? l?i cho câu h?i: 'B?n có ???c phép làm ?i?u ?ó hay không?'.

C?p phép trong ASP. NET có ba hình th?c: c?p phép s? d?ng Danh sách ?i?u khi?n truy c?p (ACL), c?p phép s? d?ng ??òng d?n URL và c?p phép programmatic.

9.2.1. C?p phép ACL

Danh sách ?i?u khi?n truy c?p (ACL) ???c dùng trong Windows NT, Windows 2000, Windows XP và Windows Sever 2003 ?? ki?m soát truy c?p tài nguyên h? th?ng nh? các t?p, th? m?c trong h? th?ng file NTFS. B?n có th? gán m?t s? tài nguyên nh?t ??nh vào ACL cho tài kho?n ng??i dùng ho?c m?t nhóm ng??i dùng Windows ?? cho phép h? truy c?p tài nguyên ho?c xác ??nh ki?u truy c?p (??c, ghi, thay ??i…) ???c phép dùng.

Th?m ??nh ACL ch? y?u ???c dùng v?i th?m ??nh Windows trong ASP. NET. IIS s? d?ng nhân d?ng ng??i dùng ?ã qua th?m ??nh ?? th?c hi?n các ki?m tra ACL và c?ng có th? ??a ra các yêu c?u v? tài nguyên ???c b?o v? b?i ACL. b?ng cách dùng ng? c?nh b?o m?t c?a ng??i dùng, n?u impersonation ???c cho phép.

?? b?o v? m?t file dùng ACL, kích ph?i chu?t lên file trong Windows Explorer và ch?n Properties. Ti?p theo, b?m ch?n th? Security ?? xem ng??i dùng, nhóm ng??i dùng và ??c quy?n hi?n th?i có trên file. S? d?ng các nút Add và Remove ?? thêm ho?c b?t tài kho?n ng??i dùng, nhóm ng??i dùng và ?ánh d?u ho?c b? d?u ? các ô trong ph?n Permissions ?? thay ??i ??c quy?n cho ng??i dùng.

(Trong Windows XP, th? Security có th? không xu?t hi?n trên h?p tho?i Properties c?a file hay folder n?u ch?c n?ng Simple File Sharing ???c b?t. ?? xem li?u thành ph?n này có ?ang ???c b?t hay không, vào Tools > Folder Options trong Windows Explorer. Sau ?ó ch?n th? View, vào ph?n Advanced Settings, b? d?u ch?n trong ô "Use simple file sharing (recommended)" ?i là ???c).

M?t trong nh?ng vi?c c?n làm ??u tiên trong là lo?i b? nhóm Everyone ra kh?i th? m?c, do nhóm này cho phép b?t k? ai truy c?p máy tính c?ng có th? truy c?p file này.

Khi lo?i b? m?t s? tài kho?n ??c bi?t (nh? SYSTEM) kh?i các danh sách ACL chúng ta c?n th?n tr?ng. M?t s? file h? ?i?u hành ?òi h?i ph?i có tài kho?n SYSTEM m?i ???c phép truy c?p ?? th?c hi?n các ch?c n?ng c?a h? ?i?u hành. Vì th? lo?i b? nh?ng ??c quy?n này có th? là nguyên nhân gây ra nhi?u v?n ?? nghiêm tr?ng. th?m chí d?n ??n không kh?i ??ng ???c h? ?i?u hành.

9.2.2. C?p phép URL

Ch? ?? c?p phép URL s? d?ng các y?u t? và c?a ph?n t? c?u hình ?? ki?m soát truy c?p file, th? m?c bên trong ?ng d?ng, gi?ng nh? trong ví d? ? th?m ??nh Forms. Truy c?p có th? ???c cho phép ho?c b? t? ch?i d?a trên tên ng??i dùng (username), vai trò (role) và ph??ng th?c HTTP dùng ?? yêu c?u tài nguyên. Do ?ó, l?y ví d?, n?u cho phép ng??i dùng Marcie truy c?p t?t c? tài nguyên trong ?ng d?ng theo t?t c? ph??ng th?c yêu c?u c?a HTTP, nh?ng c?m ng??i dùng Charles th?c hi?n yêu c?u POST, chúng ta s? ph?i thêm ph?n vào sau file web.config ? m?c g?c c?a ?ng d?ng (ho?c có th? thêm ph?n vào file web.config trong m?t th? m?c con ?? ghi ?è ho?c thêm các thi?t l?p):

Nh? trên hình 9-1, chúng ta có th? dùng th? v?i thu?c tính path cho ?i?u khi?n truy c?p c?a m?t file hay folder c? th?:

Do th? trong file web.config ?òi h?i c?p th? riêng c?a nó nên th? luôn xu?t hi?n bên trong các th? và nh?ng bên ngoài các th? và. Chúng ta có th? ??nh ngh?a ít hay nhi?u th? khác nhau tu? ý. M?i th? có th? ch?a nh?ng gi?i h?n c?p phép URL riêng.

?? mô t? mi?n thay cho các tài kho?n hay nhóm c?c b?, chúng ta có th? s? d?ng ??nh d?ng domainname userorgroupname khi mô t? tên trong và. Có hai ký t? ??c bi?t: '*' cho phép t?t c? ng??i dùng, '?' là ch? nh?ng ng??i dùng n?c danh (không qua th?m ??nh). Cu?i cùng, có th? mô t? nhi?u ng??i dùng ho?c nhóm ng??i dùng cùng m?t lúc trong và b?ng d?u ph?y.

9.2.3 C?p phép Programmatic (programmatic authorization)

Chúng ta có th? th?c hi?n các ki?m tra programmatic t?i th?i gian ch?y b?ng cách xác ??nh xem li?u ng??i dùng có ???c phép th?c hi?n m?t hành ??ng nào ?ó hay không. Công c? ch? y?u ?? th?c hi?n ?i?u này là ph??ng th?c IsInRole, ???c ??nh ngh?a b?i giao di?n IPrincipalvà có th? truy c?p t? thu?c tính User c?a l?p Page. C?ng nh? v?i c?p phép ACL, ph??ng th?c này h?u ích nh?t khi dùng v?i c? ch? th?m ??nh Windows và khi mu?n ki?m tra xem li?u li?u ng??i dùng ?ã qua th?m ??nh thu?c nhóm Windows nào, nh? nhóm manager (qu?n lý) ch?ng h?n. Chúng ta có th? l?y ví d? minh ho? cho vi?c s? d?ng IsInRole nh? bên d??i:

If Page. User. IsInRole("Managers") Then 'perform some action restricted to managers Else Message. Text = "You must be a manager to perform this action" End If

B?n ??c thân m?n, có th? th?y rõ b?o m?t ?ng d?ng trong ASP. NET t?p trung làm rõ hai v?n ?? th?m ??nh ( authentication ) và c?p phép ( authorization ). Song ngoài hai khái ni?m chính này chúng ta c?ng c?n bi?t ??n m?t s? y?u t? ?áng quan tâm khác mà có d?p chúng tôi s? ti?p t?c chuy?n t?i các b?n vào m?t ngày g?n nh?t. Hy v?ng các b?n ?ã có ???c m?t tài li?u tham kh?o h?u ích t? ph?n bài d?ch này c?a tác gi?. Trong quá trình d?ch không th? tránh kh?i m?t s? sai sót, mong các b?n góp ý ?? giúp tác gi? s?a ch?a nh?m ph?c v? b?n ??c m?t tác ph?m hay h?n và chính xác h?n.

FAQ

What is Authentication: Secure Asp. Net about?

It provides a structured overview of authentication, explains the main context, and highlights practical takeaways for readers.

Why does this topic matter?

Understanding the main concepts helps readers evaluate the issue, avoid common mistakes, and make better-informed decisions.

How should readers use this information?

Use the guidance as a practical starting point, confirm details that may have changed, and follow current product, safety, or security recommendations.