Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 235Customize PolicyIf your Web application contains code that requires more permissions than aregranted by a particular ASP.NET trust level, the easiest option is customizing a policyfile to grant the additional code access security permission to your Web application.You can either modify an existing policy file and grant additional permissions orcreate a new one based on an existing policy file.Note If you modify one of the built-in policy files, for example, the medium-trustWeb_mediumtrust.config policy file, this affects all applications that are configured to run withmedium trust. To customize policy for a specific application1. Copy one of the existing policy files to create a new policy file. For example, copythe medium trust policy file and create a new policy file such as the following:%windir%\Microsoft.NET\Framework\{version}\CONFIG\web_yourtrust.config2. Add the required permission to the ASP.NET permission set in the policy file or,alternatively, modify an existing permission to grant a less restrictive permission.3. Add a new mapping beneath in Machine.configfor the new trust level file, as follows:. . .4. Configure your application to run with the new trust level by configuring the element in the application’s Web.config file, as follows: