Improving Web Application Security: Threats and - CGISecurity

140 Part III: Building Secure Web ApplicationsSystem.Web.SecurityWindows, Forms andPassport authenticationfor Web applicationsURL and FileauthorizationSystem.SecuritySecurity ExceptionOther AttributesSystem.Security.PolicyCode-BasedSecuritySystem.Security.CryptographyEncryptionDecryptionHashingRandom NumbersSystem.Security.PrincipalUser-BasedSecuritySystem.Security.PermissionsCode-BasedSecurityFigure 6.3.NET Framework security namespacesSystem.SecurityThis namespace contains the CodeAccessPermission base class from which all othercode access permission types derive. You are unlikely to use the base class directly.You are more likely to use specific permission types that represent the rights of codeto access specific resource types or perform other privileged operations. For example,FileIOPermission represents the rights to perform file I/O, EventLogPermissionrepresents the rights for code to access the event log, and so on. For a full list of codeaccess permission types, see Table 6.2 later in this chapter.The System.Security namespace also contains classes that encapsulate permissionsets. These include the PermissionSet and NamedPermissionSet classes. The typesyou are most likely to use when building secure Web applications are:● SecurityException. The exception type used to represent security errors.● AllowPartiallyTrustedCallersAttribute. An assembly-level attribute used withstrong named assemblies that must support partial trust callers. Without thisattribute, a strong named assembly can only be called by full trust callers (callerswith unrestricted permissions.)