Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 287HttpContext context = HttpContext.Current;// Get the service provider from the contextIServiceProvider iServiceProvider = context as IServiceProvider;//Get a Type which represents an HttpContextType httpWorkerRequestType = typeof(HttpWorkerRequest);// Get the HttpWorkerRequest service from the service provider// NOTE: When trying to get a HttpWorkerRequest type from the HttpContext// unmanaged code permission is demanded.HttpWorkerRequest httpWorkerRequest =iServiceProvider.GetService(httpWorkerRequestType) as HttpWorkerRequest;// Get the token passed by IISIntPtr ptrUserToken = httpWorkerRequest.GetUserToken();// Create a WindowsIdentity from the tokenWindowsIdentity winIdentity = new WindowsIdentity(ptrUserToken);// Impersonate the userResponse.Write("Before impersonation: " +WindowsIdentity.GetCurrent().Name + "");WindowsImpersonationContext impContext = winIdentity.Impersonate();Response.Write("Impersonating: " + WindowsIdentity.GetCurrent().Name + "");// Place resource access code here// Stop impersonatingimpContext.Undo();Response.Write( "After Impersonating: " +WindowsIdentity.GetCurrent().Name + "");Note This approach assumes Forms or Passport authentication where your application’s virtualdirectory is configured in IIS to support anonymous access.If you use this code, use the following configuration:Note The code demands the unmanaged code permissionSecurityPermission(SecurityPermissionFlag.UnmanagedCode), which is granted only to fully trustedWeb applications.