Nowadays it's quite common for us to write server-based applications. These apps differ from desktop applications in many ways - one of the most important of which is how they handle security. For a desktop application, security is easy. The application runs in the security context of the user who loaded it. Whatever the user has rights to, the desktop app has rights to, and nothing more. Server-based applications, on the other hand, run all the time and have their own security context, in addition to others they may impersonate.