Improving Web Application Security: Threats and - CGISecurity

How To: Create a Custom Encryption Permission 8195. Add the following finally block to the outer try block in the Encrypt method.finally{CodeAccessPermission.RevertAssert();}6. Locate the Decrypt method in dataprotection.cs, and add the following code atthe top of the outer try block.StorePermissionFlag storeFlag;if(Store.USE_MACHINE_STORE == store){storeFlag = StorePermissionFlag.Machine;}else{storeFlag = StorePermissionFlag.User;}// Demand custom EncryptionPermission.(new EncryptionPermission(EncryptionPermissionFlag.Decrypt, storeFlag)).Demand();// Assert the unmanaged code permission.(new SecurityPermission(SecurityPermissionFlag.UnmanagedCode)).Assert();7. Add the following finally block to the outer try block in the Decrypt method.finally{CodeAccessPermission.RevertAssert();}Step 5. Call DPAPI from a Medium Trust Web ApplicationTo use the DPAPI managed wrapper from a medium trust Web application or anypartial trust code, you must configure code access security policy to grant the codethe custom EncryptionPermission.In this step, you create a test Web application and then modify ASP.NET codeaccess security policy for a medium trust Web application to grant it theEncryptionPermission.