Improving Web Application Security: Threats and - CGISecurity

234 Part III: Building Secure Web ApplicationsTable 9.3 Default ASP.NET Policy Permissions and Trust Levels (continued)Permission and State High Medium Low MinimalSecurityPermissionUnrestrictedAssertionExecutionControlThreadControlPrinicipalRemotingConfigurationSocketPermissionUnrestrictedSqlClientPermissionUnrestricted WebPermissionUnrestricted $OriginHost$Approaches for Partial Trust Web ApplicationsIf you develop a partial-trust application or enable an existing application to run at apartial-trust level, and you run into problems because your application is trying toaccess resources for which the relevant permissions have not been granted, you canuse two basic approaches:● Customize policyCustomize policy to grant the required permissions to your application. Thismight not be possible, for example in hosting environments, where policyrestrictions are rigid.● Sandbox privileged codePlace resource access code in a wrapper assembly, grant the wrapper assembly fulltrust (not the Web application), and sandbox the permission requirements ofprivileged code.The right approach depends on what the problem is. If the problem is related to thefact that you are trying to call a system assembly that does not containAllowPartiallyTrustedCallersAttribute, the problem becomes how to give a piece ofcode full trust. In this scenario, you should use the sandboxing approach and grantthe sandboxed wrapper assembly full trust.Note Customizing policy is the easier of the two approaches because it does not require anydevelopment effort.