Our hosting platform (running IIS6/ASP.
NET 2.0) is configured
to run under partial trust.
In the machine wide
web.config file we set the
ASP.
NET trust level
to Medium (and lock
to prevent overrides) and use a modified policy file.
When trying
to add a custom HttpHandler
to handle .aspx requests for a website running
in this configuration I
get the following security exception:
Security Exception
Description: The application attempted
to perform an operation not allowed by the security policy.
To grant this application the required permission please contact your system administrator or change the application's trust level
in the configuration file.
Exception Details: System.Security.SecurityException: Request failed.
Source Error:
An unhandled exception was generated during the execution of the current
web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[SecurityException: Request failed.]
System.Reflection.Assembly._GetType(String name, Boolean throwOnError, Boolean ignoreCase) +0
System.Reflection.Assembly.GetType(String name, Boolean throwOnError, Boolean ignoreCase) +42
System.
Web.Compilation.CompilationUtil.GetTypeFromAssemblies(AssemblyCollection assembliesCollection, String typeName, Boolean ignoreCase) +172
System.
Web.Compilation.BuildManager.GetType(String typeName, Boolean throwOnError, Boolean ignoreCase) +291
System.
Web.Configuration.ConfigUtil.GetType(String typeName, String propertyName, ConfigurationElement configElement, XmlNode node, Boolean checkAptcaBit, Boolean ignoreCase) +52
I'm using a class derived from PageHandlerFactory, for example:
public class MyPageHandlerFactory : PageHandlerFactory
{
public override System.
Web.IHttpHandler
GetHandler(System.
Web.HttpContext context,
string requestType,
string virtualPath,
string path)
{
// CustomPageHandler derives from System.
Web.UI.Page
return new CustomPageHandler();
}
}
My
web.config httpHandler configuration is as follow:
<httpHandlers>
<add verb="*" path="*.aspx" type="MyPageHandler.MyPageHandlerFactory" />
</httpHandlers>
The documentation for PageHandlerFactory shows that PageHandlerFactory is decorated with the following attributes:
[PermissionSetAttribute(SecurityAction.LinkDemand, Unrestricted = true)]
[PermissionSetAttribute(SecurityAction.InheritanceDemand, Unrestricted = true)]
public class PageHandlerFactory : IHttpHandlerFactory
Does this mean that I need
to set
ASP.
NET to run at Full Trust
to be able
to create my own PageHandlerFactory classes?
