Improving Web Application Security: Threats and - CGISecurity

How To: Create a Custom Encryption Permission 815Step 2. Create the EncryptionPermissionAttribute ClassThe .NET Framework uses attribute classes that are associated with their partnerpermission classes to encode permission instances. You need permission attributes tosupport declarative security syntax. To create the EncryptionPermissionAttribute class1. Add a new class file to the current project, EncryptionPermissionAttribute.cs.2. Add the following using statements to the top of the new file.using System.Security;using System.Diagnostics;using System.Security.Permissions;3. Derive the attribute class from CodeAccessSecurityAttribute, and seal it.public sealed class EncryptionPermissionAttribute :CodeAccessSecurityAttribute4. Add serialization support to the class, and use the AttributeUsage attribute toindicate where the custom permission attribute can be used.[Serializable,AttributeUsage(AttributeTargets.Method | // Can use on methodsAttributeTargets.Constructor | // Can use on constructorsAttributeTargets.Class | // Can use on classesAttributeTargets.Struct | // Can use on structuresAttributeTargets.Assembly, // Can use at the assembly levelAllowMultiple = true,// Can use multiple attribute// instances per program element// (class, method and so on)Inherited = false)]// Can not be inherited5. Add private member variables to the class to mirror the state maintained by theassociated permission class.// The following state fields mirror those used in the associated// permission type.private bool _encrypt = false;private bool _decrypt = false;private bool _machineStore = false;private bool _userStore = false;6. Replace the default constructor with the following constructor.// Pass the action code back to the base class.public EncryptionPermissionAttribute(SecurityAction action) : base(action){}