Security for SharePoint Web Parts using Code Access Security

 

Installing Web Parts in the GAC can cause serious security implications - web parts installed in the GAC are run with full trust.

Installing Web Parts in the bin folder is another option. Web parts installed in the bin folder run with partial trust and access to the system resources is limited.If the Web Part needs additional level of permissions, a best practice recommendation is to create a custom CAS policy for the specific permissions required.

WSS ships with 2 security level definitions - WSS_Minimal and WSS_Medium.

You can also build your own policy file which can be deployed along with the SharePoint Solution. The stsadm option -allowCasPolicies would allow deployment of the custom policy when deploying the solution (deploySolution operation).

Here are some good resources on setting up the CAS policy for your SharePoint Web Part.

• C-Dog: How to configure Code Access Security for a Web Part
• Patrick Tisseghem: One CAS Policy for Many Web Part Assemblies
• S.S.Ahmed: MOSS 2007 and Code Access Security
  

Happy Coding!