What is CAS Trust Level - Code Access Security Print

Trust Levels define the permissions granted to .NET applications based on their execution environment. This concept is especially relevant in Windows Hosting, such as IIS (Internet Information Services), where multiple web applications might run on the same server.

CAS Trust Levels in .NET

1. What are CAS Trust Levels? CAS Trust Levels are predefined security configurations that restrict the operations that an application can perform based on its trust level. They help secure applications by limiting their access to resources and capabilities.

2. Common Trust Levels:

   • Full Trust:
     • Grants the application unrestricted access to all resources and operations.
     • Typically used for applications that are fully trusted by the server administrator.
   • High Trust:
     • Allows access to most resources but applies some restrictions (e.g., no unmanaged code execution).
   • Medium Trust:
     • Restricts access to sensitive resources like the file system outside the application's directory.
     • Prevents potentially dangerous operations.
   • Low Trust:
     • Provides minimal permissions, suitable for shared hosting environments.
   • Custom Trust:
     • A custom-defined policy to meet specific requirements, balancing security and functionality.

3. How CAS Trust Levels Impact Windows Hosting:

   • Application Isolation:
     • CAS ensures that one application cannot interfere with another in shared hosting environments, enhancing security.
   • Resource Access Control:
     • Restricts applications from accessing unauthorized resources, reducing risks of data leakage or unauthorized modifications.
   • Performance:
     • Lower trust levels can prevent certain operations, which might improve server performance by reducing potential misuse.
   • Compatibility:
     • Some applications might require higher trust levels to function correctly. If not granted, features like reflection or file access may fail.
   • Security:
     • Lower trust levels protect the server and other hosted applications from malicious or buggy applications.

4. Managing Trust Levels in IIS:

   • Trust levels are configured in the web.config file or the server's machine.config file under the <trust> element.
   • Example configuration for Medium Trust: