Improving Web Application Security: Threats and - CGISecurity

8Code Access Security in PracticeIn This Chapter●●●●●●●OverviewCode access security explainedUsing APTCARequesting permissionsSandboxing privileged codeAuthorizing code with identity demandsSerialization, delegates, and threadingCalling unmanaged codeCode access security is a resource constraint model designed to restrict the types ofsystem resource that code can access and the types of privileged operation that thecode can perform. These restrictions are independent of the user who calls the codeor the user account under which the code runs.Code access security delivers three main benefits. By using code access security,you can:● Restrict what your code can doFor example, if you develop an assembly that performs file I/O you can usecode access security to restrict your code’s access to specific files or directories.This reduces the opportunities for an attacker to coerce your code to accessarbitrary files.