What is CAS (Code Access Security) in .NET, and how to achieve it? What are the benefits of using it?
Asked
Active
Viewed 6,186 times
9
-
In case anyone lands up on this thread looking for it in .Net Core - [Code Access Security (CAS) based sandboxing is **not** supported in .Net Core](https://blogs.msdn.microsoft.com/dotnet/2016/02/10/porting-to-net-core/). You will have to use full .Net Framework in order to use CAS. – RBT Nov 16 '17 at 00:41
1 Answers
13
In short, CAS is the security sandbox for .NET. Local apps typically have full trust which means they can do anything. .NET apps that are hosted in the browser can't do much. In between, just about any security setting can be fine-tuned using CAS.
It's benefits: great control over what .NET apps can do, even within the context of the logged in user. The best part about it, IMO, is that security checks walk the stack, so that even if some code has permission to do something, if that method was called by another program that doesn't have permission to do something, that request will fail (unless special measures are taken).
The downsides: it's a pretty complex beast to learn. Lots of gotchas.
riQQ
- 9,878
- 7
- 49
- 66
Andrew Arnott
- 80,040
- 26
- 132
- 171