Improving Web Application Security: Threats and - CGISecurity

192 Part III: Building Secure Web ApplicationsDiagnosing APTCA IssuesIf you attempt to call a strong named assembly that is not marked with APTCA frompartial trust code such as a partial trust Web application, you see an exception similarto the one shown in Figure 8.4. Notice that the exception details provide nopermission details and simply indicate that the required permissions (in this case,FullTrust) cannot be acquired from the calling assembly. In this case, the somewhatconfusing description text means that the error occurred because the application’s level was set to something other than Full.Figure 8.4The result of partial trust code calling a strong named assemblyTo overcome this exception, either the calling code must be granted FullTrust or theassembly being called must be annotated with APTCA. Note that individual typeswithin an assembly marked with APTCA might still require full trust callers, becausethey include an explicit link demand or regular demand for full trust, as shown in thefollowing examples.[PermissionSet(SecurityAction.LinkDemand, Name="FullTrust")][PermissionSet(SecurityAction.Demand, Unrestricted=true)]