Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 225If an application is configured with a trust level other than “Full,” it is referred to as apartial-trust application. Partial-trust applications have restricted permissions, whichlimit their ability to access secured resources.Important Web applications built on .NET Framework version 1.0 always run with full trust becausethe types in System.Web demand full-trust callers.Configuring Code Access Security in ASP.NETBy default, Web applications run with full trust and have unrestricted permissions. Tomodify code access security trust levels in ASP.NET, you have to set a switch inMachine.config or Web.config and configure the application as a partial-trustapplication.Configuring Trust LevelsThe element in Machine.config controls whether or not code access security isenabled for a Web application. Open Machine.config, search for ““, and youwill see the following.With the trust level set to “Full,” code access security is effectively disabled becausepermission demands do not stand in the way of resource access attempts. This is theonly option for ASP.NET Web applications built on .NET Framework version 1.0. Asyou go through the list from “Full” to “Minimal,” each level takes away morepermissions, which further restricts your application’s ability to access securedresources and perform privileged operations. Each level gives greater degrees ofapplication isolation. Table 9.1 shows the predefined trust levels and indicates themajor restrictions in comparison to the previous level.