Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 2374. Install the wrapper assembly in the GAC.This gives full trust to the wrapper, but not the Web application. The ASP.NETpolicy files contain the following code group, which grants full trust to anyassembly located in the GAC:Note Default enterprise and local machine policy also grant full trust to any code located in theMy Computer zone, which includes code installed in the GAC. This is important because grantedpermissions are intersected across policy levels.5. Configure the Web application trust level (for example, set it to “Medium”).Figure 9.2 shows the sandboxing approach.Demand thenAssertPartial TrustWebApplicationWrapperAssembly(Strong Namedin the GAC)ResourceAccessSecuredResourceSandboxed CodeFigure 9.2Sandboxing privileged code in its own assembly, which asserts the relevant permissionIt is good practice to use separate assemblies to encapsulate resource access andavoid placing resource access code in .aspx files or code behind files. For example,create a separate data access assembly to encapsulate database access. This makes iteasier to migrate applications to partial-trust environments.