Rick van den Bosch - Blog

... on software development, architecture and more

SecurityException: That assembly does not allow partially trusted callers.

The exception mentioned in the title of this post was the one I encountered when using an ASP.Net control I had written.

How I encountered the exception:
Because I develop several websites, there's a lot of functionality I need more than once. A possible solution for this is to write a control gallery containing the functionality I needed. And putting them in a seperate assembly makes it easy to dstribute them freely in the near future ;). I made the assembly (containing an image gallery and a download gallery) and used it in a website I am developing together with a good friend of mine. There were no problems and life seemed good. Until the day came we published the website. After putting the website online, one of the pages was not rendering correctly, displaying the message "Unhandled Exception: System.Security.SecurityException: That assembly does not allow partially trusted callers".

The reason for the exception:
Lots of providers don't run websites in Full Trust mode. Because of that some actions you can take inside a (referenced) assembly aren't allowed. For me I'm not sure if the problem was the scanning of the hard drive or the fact I get embedded images from the assembly. One way or the other: there was stuff in there which wasn't allowed ;).

Taking care of the exeption:
The solution I used to solve this problem was pretty straight-forward: I added the AllowPartiallyTrustedCallersAttribute to the assembly. Another solution could have been to extract the controls from the seperate assembly and put them inside the website, but I didn't prefer that. This article on the .Net security blog explains a bit more about the AllowPartiallyTrustedCallersAttribute...

Comments

Nathan Pledger said:

Yes, I hit this little gem last week. I'm about to launch a Buddhist resource site whereby you can buy and download content. The client wants to integrate with PayPal. If you recall my post about "What is the point" I blogged (sorry, ranted) about the alternative Postback "feature", which is absoltuely pointless in that it does not send the form variables to the other page - in this case PayPal.

So I had to use their PayPal component, which worked REALLY well. I was getting more than a little nervous it was coming up to launch date, so was a big relief. Come to push it up, and I get exactly what you get.

The AllowPartiallyTrustedCallersAttribute is all very good - if you have access to the original source code - which I didn't. So .NET is STILL relagated to calling the PayPal API using the GET method - which I don't like because it is a little too "visible". I hate it when PHP people can do something I can't.
# April 9, 2006 9:24 AM

Erwyn van der Meer said:

If the assembly with PayPal's API (which I assume exists from Nathan's comment) does not have the AllowPartiallyTrustedCallersAttribute then either
- PayPal was ignorant to the fact that it is important to flag their assembly to allow use in partial trust scenarios.
- PayPal decided its assembly was not inherently safe to be called by callers who are not fully trusted.

Either way, Microsoft is not to blame for this. AllowPartiallyTrustedCallersAttribute is a very important security measure by Microsoft and an important thing to consider if you design assemblies for reuse. So ask PayPal for a better library ;)

Do make sure your assembly is indeed safe to be called by partially trusted callers before you apply that attribute to your own code (like the post by Shawn Farkas referenced by Rick states).
# April 11, 2006 7:51 AM

parke said:

Thank You....

# August 30, 2008 1:27 PM

kuamrs said:

i m host to server in aspx page following error comes

SecurityException: That assembly does not allow partially trusted callers.

# February 26, 2009 7:15 AM

ak said:

I have added the AllowPartiallyTrustedCallersAttribute  and i have enable debug = 'true" but i still get this message. Is there anything else I am missing.

# May 21, 2009 7:43 PM
Leave a Comment

(required) 

(required) 

(optional)

(required) 


Please add 6 and 1 and type the answer here: