Improving Web Application Security: Threats and - CGISecurity

Chapter 7: Building Secure Assemblies 159Global Assembly Cache RequirementsAny strong named assembly called by an ASP.NET Web application configured forpartial trust should be installed in the global assembly cache. This is because theASP.NET host loads all strong-named assemblies as domain-neutral.The code of a domain-neutral assembly is shared by all application domains in theASP.NET process. This creates problems if a single strong named assembly is used bymultiple Web applications and each application grants it varying permissions or ifthe permission grant varies between application domain restarts. In this situation,you may see the following error message: “Assembly .dll securitypermission grant set is incompatible between appdomains.”To avoid this error, you must place strong named assemblies in the global assemblycache and not in the application’s private \bin directory.Authenticode vs. Strong NamesAuthenticode and strong names provide two different ways to digitally sign anassembly. Authenticode enables you to sign an assembly using an X.509 certificate. Todo so, you use the Signcode.exe utility, which adds the public key part of a full X.509certificate to the assembly. This ensures trust through certificate chains and certificateauthorities. With Authenticode (unlike strong names,) the implementation ofpublisher trust is complex and involves network communication during theverification of publisher identity.Authenticode signatures and strong names were developed to solve separateproblems and you should not confuse them. Specifically:● A strong name uniquely identifies an assembly.● An Authenticode signature uniquely identifies a code publisher.Authenticode signatures should be used for mobile code, such as controls andexecutables downloaded via Internet Explorer, to provide publisher trust andintegrity.You can configure code access security (CAS) policy using both strong names andAuthenticode signatures in order to grant permissions to specific assemblies.However, the Publisher evidence object, obtained from an Authenticode signature isonly created by the Internet Explorer host and not by the ASP.NET host. Therefore, onthe server side, you cannot use an Authenticode signature to identify a specificassembly (through a code group.) Use strong names instead.For more information about CAS, CAS policy and code groups, see Chapter 8, “CodeAccess Security in Practice.”