CODEWITHSUNDEEP
asp.netcode-access-security
Paul
Paul

Reputation: 6228

What Does CAS Protect an ASP.NET Application From?

What kind of malicious attack(s) is code access security supposed to protect an ASP.NET application from? Presuming a non-exotic scenerio, an ASP.NET app running on it's own box where you have full control over the application and server.

Upvotes: 0

Views: 133

Answers (1)

Nicole Calinoiu
Nicole Calinoiu

Reputation: 20992

CAS on an ASP.NET server has two main uses:

  1. Protect other resources on the server (such as other ASP.NET applications) from potentially malicious server-side code included in any given ASP.NET application.
  2. Provide defense-in-depth against potential attacks by users of any given ASP.NET application.

If you are the author of the one and only application hosted on your own server, scenario #1 is probably not particularly interesting to you. However, the defense-in-depth aspects might be more compelling. For example, running under medium trust could help thwart an exploit that attempts to read or write to file system locations outside the target application's directory, and that should be interesting even if you're all alone on your own server.

Upvotes: 1

Related Questions