Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 251 To create a custom policy to allow registry access1. Copy the Web_mediumtrust.config file, which is in the following directory, to afile called Web_mediumtrust_Registry.config, which is located in the samedirectory.%windir%\Microsoft.NET\Framework\{version}\CONFIGBy making a copy and creating a custom policy file, you avoid making changesdirectly to the Web_mediumtrust.config file. Making changes directly to thedefault medium trust file affects every application on the machine that isconfigured for medium trust.2. Locate the element and add the following to register theRegistryPermission class:3. Locate the ASP.NET permission set and add the unrestricted RegistryPermissionto the permission set as follows:4. Save the file.5. Update Machine.config to create a new trust level that is mapped to the newpolicy file.6. Update your application’s Web.config to configure the application’s level.