Our hosting platform (running IIS6/ASP.NET 2.0) is configured to run under partial trust. In the machine wide web.config file we set the ASP.NET trust level to Medium (and lock to prevent overrides) and use a modified policy file.
When trying to add a custom HttpHandler to handle .aspx requests for a website running in this configuration I get the following security exception:
Security Exception
Description: The
application attempted to perform an operation not allowed by the security policy. To grant this
application the required permission please contact your system administrator or change the
application's trust level in the configuration file.
Exception Details: System.Security.SecurityException: Request failed.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[SecurityException: Request failed.]
System.Reflection.Assembly._GetType(String name, Boolean throwOnError, Boolean ignoreCase) +0
System.Reflection.Assembly.GetType(String name, Boolean throwOnError, Boolean ignoreCase) +42
System.Web.Compilation.CompilationUtil.GetTypeFromAssemblies(AssemblyCollection assembliesCollection, String typeName, Boolean ignoreCase) +172
System.Web.Compilation.BuildManager.GetType(String typeName, Boolean throwOnError, Boolean ignoreCase) +291
System.Web.Configuration.ConfigUtil.GetType(String typeName, String propertyName, ConfigurationElement configElement, XmlNode node, Boolean checkAptcaBit, Boolean ignoreCase) +52
I'm using a class derived from PageHandlerFactory, for example:
public class MyPageHandlerFactory : PageHandlerFactory
{
public override System.Web.IHttpHandler
GetHandler(System.Web.HttpContext
context,
string requestType,
string virtualPath,
string path)
{
// CustomPageHandler derives from System.Web.UI.Page
return new CustomPageHandler();
}
}
My web.config httpHandler configuration is as follow:
<httpHandlers>
<add verb="*" path="*.aspx" type="MyPageHandler.MyPageHandlerFactory" />
</httpHandlers>
The documentation for PageHandlerFactory shows that PageHandlerFactory is decorated with the following attributes:
[PermissionSetAttribute(SecurityAction.LinkDemand, Unrestricted = true)]
[PermissionSetAttribute(SecurityAction.InheritanceDemand, Unrestricted = true)]
public class PageHandlerFactory : IHttpHandlerFactory
Does this mean that I need to set ASP.NET to run at Full Trust to be able to create my own PageHandlerFactory classes?
