Improving Web Application Security: Threats and - CGISecurity

How To: Create a Custom Encryption Permission 8216. Add the following code for the Decrypt button-click event handler.private void btnDecrypt_Click(object sender, System.EventArgs e){DataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE);try{byte[] dataToDecrypt = Convert.FromBase64String(txtEncryptedData.Text);// Optional entropy parameter is null.// If entropy was used within the Encrypt method, the same entropy// parameter must be supplied here.txtDecryptedData.Text =Encoding.ASCII.GetString(dp.Decrypt(dataToDecrypt,null));}catch(Exception ex){lblError.ForeColor = Color.Red;lblError.Text = "Exception." + ex.Message;return;}lblError.Text = "";}7. Configure the Web application for medium trust by adding the following elementto the application’s Web.config file inside the section.8. Build the solution. To modify medium trust policy1. Open the medium trust policy file using Visual Studio ® .NET or Notepad. Thepolicy file is in the following location.%windir%\Microsoft.NET\Framework\{version}\CONFIG\web_mediumtrust.config2. Declare the EncryptionPermission by adding the following element to the element.Set the PublicKeyToken attribute value to the specific public key token for yourassembly. To extract the public key token for your custom permission assembly,use the following command.sn -T custompermission.dllNote Use a capital -T switch.