Improving Web Application Security: Threats and - CGISecurity

194 Part III: Building Secure Web ApplicationsPrivileged OperationsPrivileged operations are shown in Table 8.2, together with the associatedpermissions that calling code requires.Table 8.2 Privileged Operations and Associated PermissionsOperationRequires PermissionCreating and controlling applicationdomainsSecurityPermission withSecurityPermissionFlag.ControlAppDomainSpecifying policy application domainsAsserting security permissionsCreating and manipulating evidenceCreating and manipulating principalobjectsConfiguring types and channelsremotingManipulating security policySerializationThreading operationsReflectionCalling unmanaged codeSecurityPermission withSecurityPermissionFlag.ControlDomainPolicySecurityPermission with SecurityPermissionFlag.AssertionSecurityPermission withSecurityPermissionFlag.ControlEvidenceSecurityPermission withSecurityPermissionFlag.ControlPrincipalSecurityPermission withSecurityPermissionFlag.RemotingConfigurationSecurityPermission withSecurityPermissionFlag.ControlPolicySecurityPermission withSecurityPermissionFlag.SerializationFormatterSecurityPermission withSecurityPermissionFlag.ControlThreadReflectionPermissionSecurityPermission withSecurityPermissionFlag.UnmanagedCodeRequesting PermissionsWhen you design and develop your assemblies, create a list of all the resources thatyour code accesses, and all the privileged operations that your code performs. Atdeployment time, the administrator may need this information to appropriatelyconfigure code access security policy and to diagnose security related problems.The best way to communicate the permission requirements of your code is to useassembly level declarative security attributes to specify minimum permissionrequirements. These are normally placed in Assemblyinfo.cs or Assemblyinfo.vb.This allows the administrator or the consumer of your assembly to check whichpermissions it requires by using the Permview.exe tool.