Using the .NET Edition in ASP.NET Medium Trust

ASP.NET applications on the .NET Framework can be configured to run in partial trust (such as medium trust) using the trust element in web.config. In medium trust, Code Access Security (CAS) restricts the permissions that are granted to the application, and some of the permissions required by the components are not granted by default. This entry explains how to create a custom trust level that grants these permissions.

This applies only to ASP.NET applications that run on the .NET Framework. ASP.NET Core applications, and applications that run on .NET 5 and later, do not support Code Access Security, and do not require any trust configuration.

Note that Microsoft no longer considers ASP.NET partial trust to be a security boundary, and recommends running applications in full trust (the default), isolated in separate application pools. Where possible, running the application in full trust is the simplest solution.

Required Permissions

The components require the following permissions:

The last two permissions can be avoided as described below, so in many cases, only SocketPermission must be added.

Creating a Custom Trust Level

To create a custom trust level based on medium trust:

1. Copy the medium trust policy file of the .NET Framework (web_mediumtrust.config, located in %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\Config, or in the Framework folder for 32-bit applications) to the application folder, and rename it to web_customtrust.config.
2. Edit web_customtrust.config as described below.
3. Define the custom trust level in the web.config file of the application, and set the trust level to use it.

<configuration>
  <system.web>
    <securityPolicy>
      <trustLevel name="Custom" policyFile="web_customtrust.config" />
    </securityPolicy>
    <trust level="Custom" />
  </system.web>
</configuration>

Note that some hosting providers do not allow the trust level to be changed in web.config. In this case, please contact the hosting provider.

Adding SocketPermission

In web_customtrust.config, add the SocketPermission class to the SecurityClasses element:

<SecurityClass Name="SocketPermission" Description="System.Net.SocketPermission, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>

Then, grant the permission in the permission set named ASP.Net:

<IPermission class="SocketPermission" version="1" Unrestricted="true"/>

Updating SecurityPermission

If the components must call the system security libraries, or the standard .NET licensing scheme is used (see below), add the required flags to the SecurityPermission element of the ASP.Net permission set:

<IPermission class="SecurityPermission" version="1" Flags="Execution, ControlThread, ControlPrincipal, RemotingConfiguration, SkipVerification, UnmanagedCode, SerializationFormatter"/>

Only the flags that are required should be added.

Avoiding Unmanaged Code

By default, the components use the system security libraries for cryptographic operations, which requires calls to unmanaged code. To use the internal (fully managed) implementation instead, set the UseInternalSecurityAPI configuration setting to true. In this case, the UnmanagedCode and SkipVerification flags are not required.

component.Config("UseInternalSecurityAPI=true");

When using the internal implementation, do not deploy the system assembly (e.g., nsoftware.IPWorks.System.dll) in the bin folder of the application. Note that Visual Studio may copy this assembly automatically when it is referenced by the project.

Licensing

When a component is created without a runtime license, it uses the standard .NET licensing scheme, which requires the SerializationFormatter flag. In this case, add the component to the licenses.licx file of the project, so that the license is compiled into the application (e.g., into App_Licenses.dll in the bin folder of a website project).

Alternatively, pass the runtime license to the constructor of the component. In this case, the standard .NET licensing scheme is not used, and the SerializationFormatter flag is not required.

HTTP http = new HTTP("RUNTIME_LICENSE");

For more information about runtime licenses, please contact support@nsoftware.com.

Note that in older versions, the UseInternalSecurityAPI configuration setting was named UseManagedSecurityAPI.