Improving Web Application Security: Threats and - CGISecurity

How To:Create a CustomEncryption PermissionApplies ToThis information applies to server or workstation computers that run the following:● Microsoft ® Windows ® 2000 Server and Windows 2000 Professional,Windows Server 2003, Windows XP Professional● Internet Information Server (IIS)● .NET Framework 1.1SummaryThis How To describes how to create a custom code access security permission tocontrol programmatic access to unmanaged encryption functionality that Win32 ®Data Protection API (DPAPI) provides. Use this custom permission with the managedDPAPI wrapper code described in “How To: Create a DPAPI Library,” in “BuildingSecure ASP.NET Applications,” in the MSDN Library.Before You BeginCode access security permissions must derive fromSystem.Security.CodeAccessPermission, which provides an implementation of theDemand method defined by the IPermission interface, together with others such asAssert, Deny, and PermitOnly, which are defined by the IStackWalk interface.Code access permissions (not identity permissions) also implement theIUnrestrictedPermission interface, to indicate that the permission is part ofthe unrestricted permission set. This means that the permission is automaticallygranted to any code that has full trust. The inheritance hierarchy for the customEncryptionPermission implemented in this How To is shown in Figure 8.