Improving Web Application Security: Threats and - CGISecurity

Chapter 8: Code Access Security in Practice 197Usually, you do not explicitly demand code access permissions. The .NETFramework classes do this for you, and a duplicate demand is unnecessary. However,there are occasions when you need to issue explicit demands, for example, if yourcode exposes a custom resource by using unmanaged code or if your code accessescached data. You can authorize code in the following ways:● Restrict which code can call your code.●●●Restrict inheritance.Consider protecting cached data.Protect custom resources with custom permissions.Restrict Which Code Can Call Your CodeA method marked as public can be called by any code outside of the currentassembly. To further restrict which other code can call your methods, you can use acode access security identity permission demand as shown in the following example.public sealed class Utility{// Although SomeOperation() is a public method, the following// permission demand means that it can only be called by assemblies// with the specified public key.[StrongNameIdentityPermission(SecurityAction.LinkDemand,PublicKey="00240000048...97e85d098615")]public static void SomeOperation() {}}The above code shows a link demand. This results in the authorization of theimmediate caller. Therefore, your code is potentially open to luring attacks, where amalicious assembly could potentially access the protected resources or operationsprovided by your assembly through a trusted intermediary assembly with thespecified strong name.Depending on the nature of the functionality provided by your class, you may needto demand another permission to authorize the calling code in addition to using theidentity-based link demand. Alternatively, you can consider using a full demand inconjunction with the StrongNameIdentityPermission, although this assumes that allcode in the call stack is strong name signed using the same private key.Note Issuing a full stack walk demand for the StrongNameIdentityPermission does not work if yourassembly is called by a Web application or Web service. This is because it is not possible to strongname the dynamically compiled classes associated with ASP.NET Web applications or Web services.