SecureASP.NET
LANGUAGES: ALL
ASP.NET VERSIONS: 2.0
New Security Tools in Visual Studio 2005
The Permissions Calculator
By Don Kiely
It?s here! It?s here at last! On Monday, November 7th,after years of demonstrating vaporware, talking about features that might ormight not make it into the final product, whipping up frenzied excitement forits vision of the new generation of development tools, and a painfully longbeta period, Microsoft finally released the 2005 versions of Visual Studio andSQL Server. I?m sure that you joined the legions of developers around the worldwho celebrated the release by taking the first few days of this week off workto celebrate and geek out with the new tools, staying up until all hours torelish our newfound power.
Or perhaps, more likely, like me you paused on Monday whenreminded of the date and raised your early morning mug of Mountain Dew insilent salute to yet another milestone in Windows development, then got back towork on that ASP classic or ASP.NET 1.1 app that your company won?t migrate formany months. But that?s okay. Maybe it won?t rock your world today, but I betit radically changes how you develop Web sites ? at the very least by makingthem far more secure.
No matter how you marked the occasion, the fact that you?rereading this column probably means that you?re concerned with writing secureWeb applications. The really good news is that this has become way easier inVisual Studio 2005. Version 2.0 of the .NET Framework has many securityenhancements. There are more and better tools that make writing secure code farmore possible (and even enjoyable). I have to give credit to the folks atMicrosoft for putting in so much work in this area. Sure, there is still plentyto do ? and it doesn?t help that there is so much work left to be done to makeWindows itself more secure ? but if you care about your users and the securityof their systems and data, you can do a much more credible job with the newtools.
In fact, for all of the nifty new ASP.NET features, Istill think that the security enhancements are by far and away the best reasonto migrate to the 2005 and 2.0 versions. So what are these tools I?m so excitedabout? In the rest of this column I?ll tell you about one of my favorite newsecurity features; next month I?ll cover a few more, as well as why I thinkthey?ll change the way we all write code. Most of the new security tools aren?tspecific to ASP.NET applications, but instead help you write any kind of .NETcode more securely. A rising tide floats all boats, as they say, and allapplications can benefit ? but only if we all take a little time to learn howto put them to good use.
One of the most important things you can do is learn howto write partially trusted applications. I?ve written and talked about them alot over the years ? in this column, at conferences and user groups, and inarticles ? but few developers take the time to carefully design applicationsthat don?t require full trust to run. Partially trusted applications don?tautomatically receive every available permission, and thereforedo a better job of restricting access to protected resources. In other words,and grossly oversimplifying, partially trusted applications are capable of lessevil than their fully trusted brethren.
But developing partially trusted applications,particularly Web applications, has just been too darned hard. One of the mostdifficult things about it is figuring out what permissions your code requiresto run successfully, and making sure that you degrade gracefully when theapplication doesn?t have it. This is particularly true of server applications, becausethe typical user is usually powerless to do anything about the problem. Tellingthem to talk to an administrator to get the required permission just doesn?twork.
So Microsoft included the Permissions Calculator in VisualStudio 2005. The calculator scans your code and tells you what permissions itrequires in order to successfully execute the code. It does this by performinga static analysis of every .NET Framework class and method used andextrapolates the required permissions using internal data that describe thesecurity of each class and method. The result is a list of all the permissionsthat your code has, and any that it needs, but doesn?t have, given the definedenvironment.
Alas, the calculator is of no use for ASP.NET Web sitesand the code behind any pages. But wait, before you call me nuts for writingabout it here, consider that not all code in an ASP.NET application livesbehind pages. Creating a partially trusted ASP.NET application is still alargely manual process of configuration, and requires some special care in howyou design class libraries and other components. It is for these classlibraries and other components you create to run from ASP.NET page code thatthe Permissions Calculator becomes useful. The issue here is that you have tojump through a few hoops to make your class libraries callable from partiallytrusted applications of any type. Here the calculator is a big help in makingsure that the code will run when called from Web pages, eliminating much of theguesswork involved in doing the same thing in earlier versions of the .NET andVisual Studio tools. This makes it far easier to create these libraries andcomponents.
To reach the Permissions Calculator, go to ProjectProperties and select the Security tab.
Join me next month as I look at a few more of my favoritenew security tools in Visual Studio 2005.
DonKiely, MVP, MCSD, is a senior technology consultant, building customapplications as well as providing business and technology consulting services.His development work involves tools such as SQL Server, Visual Basic, C#,ASP.NET, and Microsoft Office. He writes regularly for several trade journals,and trains developers in database and .NET technologies. You can reach Don at mailto:donkiely@computer.org and readhis blog at http://www.sqljunkies.com/weblog/donkiely/.