Hello World

1. No authentication Allows all clients to access the server.
   
2. Basic authentication Authenticates users against a user list that is defined in the registry. All users must use the same password, which is set in the Network control panel.
   
3. NTLM authentication Uses the same user list as basic authentication, but the Web Server passes the authentication request to a domain controller that is specified in the registry.
   
4. SSL Client Certificates Request a certain SSL certificate from the client to log the user on. To learn how the certificates can be set up, please refer to the article on SSL Client Authentication.

[HKEY_LOCAL_MACHINE\Comm\HTTPD\VROOTS\/www]
    "(default)"="\windows\www"
    "A"=1
    "UserList" = "LoriKane; -JaneClayton; @Group1"

• A=0—No authentication
  
• A=1—V-ROOT requires a user name and password
  
• A=2—Same as 1 just with additional administrative rights for the user

• "-…" denies access to this user
  
• "@.." allow access to this group of users. The group has to match a user group in the domain that will be used to authenticate the users.
  
• "-*" deny all (domain) users
  
• "@*" allows all (domain) users

[HKEY_LOCAL_MACHINE\Comm\HTTPD]
"Basic"=1

[HKEY_LOCAL_MACHINE\Comm\HTTPD]
"NTLM"=1

• Limit deployment to ten connections simultaneously
  
  A typical deployment uses a Web Server in a private network to provide a remote user interface to configure a headless device. The registry defines the number of connections and when the MaxConnections registry value is not set, the registry limits the number to 10.
  
  
• Do not use the Web Server to perform critical operations
  
  A typical deployment uses the Web Server to display status information or to host a family or community Web site. You should not use the Web Server to perform critical operations, such as machine control or financial processing.
  
  
• Use authentication
  
  Use NTLM and/or Basic authentication mechanisms to limit access to known users only. You can set the option in the HKEY_LOCAL_MACHINE\COMM\HTTPD registry key. For specific security information, see the "Security Note" in "Base Registry Settings." For more information about authentication, see "Web Server Authentication and Permissions" in the Windows CE .NET documentation.
  
  
• Use Secure Sockets Layer (SSL)
  
  SSL protocol protects data from packet sniffing by anyone with physical access to the network. For more information, see "SSL Support" in the Windows CE. NET documentation.
  
  
• Use user access lists
  
  Carefully choose your virtual roots and limit access to the appropriate files by providing appropriate user access lists. Anonymous users with access to the virtual root may be able to access files and directories within that virtual root. You can set the options in the HKEY_LOCAL_MACHINE\Comm\HTTPD\VROOTS registry key. For specific security information, see the "Security Note" in "Virtual Path Settings." Also see "Web Server Authentication and Permissions" in the Windows CE. NET documentation.
  
  
• Remove or disable sample Internet Server APIs (ISAPIs) and other development tools when you create the retail image
  
  Some sample ISAPIs that you include in your device may allow unauthorized users to access your system resources or protected data. Many of the samples provided are for development and debugging purposes only and pose a significant security risk if deployed on a public network.