I recently deployed a C# / Silverlight / ASP.NET site to a hosting provider. While most of the site worked just fine, I ran into this rather ugly error upon hitting one part of my application:
Security Exception Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application’s trust level in the configuration file.
Exception Details: System.Security.SecurityException: Request for the permission of type ‘System.Security.Permissions.FileIOPermission, mscorlib, Version=184.108.40.206, Culture=neutral, PublicKeyToken=b77a5c561934e089’ failed.
FileIOPermission? What were they talking about? The part of my application that was throwing the exception didn’t access any files. Or so I thought.
The problem was with my calls to System.Web.Configuration.WebConfigurationManager to access the appSettings tags in the web.config file. After I discovered a post on the forums of asp.net, I discovered my error:
Most of the new configuration APIs in System.Configuration require full-trust.
Try debugging the problem in your development server by changing the Web.config so that it matches the trust level in your provider. For example,
<trust level=”Medium” />
Yep, that was it – after I added the trust tag to the web.config file in my development environment, I was able to reproduce the error locally and successfully diagnose the problem. I had to rewrite how I accessed the configuration settings, using WebConfigurationManager.AppSettings[“ConnString”] instead of the old way, but that was a relatively painless step. And now I know to run my applications that will be hosted by a provider in a medium trust environment.