Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Security / November 2006

Tip: Looking for answers? Try searching our database.

Catching Security Exceptions:

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Praveen - 22 Nov 2006 20:58 GMT
Hi,

I have code like this in one of my type's constructor:

public MyConstructor()

{

   try

   {

       AppDomain.CurrentDomain.AssemblyResolve += new
ResolveEventHandler(MyAssemblyResolver);

       ......

   }

   catch (System.Security.SecurityException){}

}

The idea is to catch the security exception that is thrown when this code is
run in partial-trust mode. But, this exception doesn't seem to get caught!
My asp.net application errors out with this message when run in
partial-trust mode:

[SecurityException: Request for the permission of type
'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.]
  MyConstructor..ctor() +0

How do I catch this excpetion?

TIA,
Praveen
Steven Cheng[MSFT] - 23 Nov 2006 07:42 GMT
Hello Praveen,

From your description, you're going to use the "AppDomain.AssemblyResolve"
event to capture any potential .NET CAS SecurityException in your ASP.net
web application, but found it not work, correct?

As for the "AppDomain.AssemblyResolve" event, it is designed for capturing
the failure of loading a certain assembly in a certain .net AppDomain, for
example, if the runtime can not find a certain assembly required by the
appdomain(or version mismatch...), it will raise this event and call your
handler if you have registered. However, it does not care about any .NET
CAS specific exception(such as the SecurityException...)

For your scenaro, you're encountering some CAS specific SecurityException
in your ASP.NET application, I think this is because some assembly you used
or your asp.net application's  components contains code that demand high
CAS permission which is not granted in partial trust environment. Such
exception would be throwed when a certain method(contains such code) be
executed. Generally, in ASP.NET, you can consider use "Application_Error"
event

#How to: Handle Application-Level Errors
http://msdn2.microsoft.com/en-us/library/24395wz3.aspx

===============
void Application_Error(object sender, EventArgs e)
   {

       Exception ex = HttpContext.Current.Server.GetLastError();

       if (ex is System.Security.SecurityException)
       {
           Server.Transfer("~/errorinfo.aspx");
       }
         }
==================

In addition, for ASP.NET CAS issue, it is recommended that we check it at
development time before deployment, and if necessary, we can consider
customize the partial trust security policy or wrapper those privileged
assemblies before deployment. Here are some article describing how to deal
with CAS in asp.net 2.0(include partial trust scenario):

#How To: Use Medium Trust in ASP.NET 2.0
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html
/paght000020.asp

#How To: Use Code Access Security in ASP.NET 2.0
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html
/paght000017.asp

Hope this helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================



This posting is provided "AS IS" with no warranties, and confers no rights.

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.