ASP.NET WebPermission Security Exception

Question

I usually hate posting these types of questions as normally I find that the best way to really learn is to figure out the answer yourself.

However, I need an answer to this question really quickly as I have a client who can't run her business due to this problem.

Yesterday my ASP.NET host provider moved my application from a server running .NET 1.1 to one running .NET 1.1 and 2.0. My problem is that when I test the move the main site page (Default.aspx) will not load

"Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed."

[SecurityException: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.] System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet) +0 System.Security.CodeAccessPermission.Demand() +59 System.Net.HttpWebRequest..ctor(Uri uri, ServicePoint servicePoint) +147 System.Net.HttpRequestCreator.Create(Uri Uri) +26 System.Net.WebRequest.Create(Uri requestUri, Boolean useUriBase) +298 System.Net.WebRequest.Create(Uri requestUri) +28 System.Web.Services.Protocols.WebClientProtocol.GetWebRequest(Uri uri) +30 System.Web.Services.Protocols.HttpWebClientProtocol.GetWebRequest(Uri uri) +12 System.Web.Services.Protocols.SoapHttpClientProtocol.GetWebRequest(Uri uri) +4 System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) +52 PilatesPlusDublin.PilatesPlusDublinws.PilatesPlus.InsertException(String sModuleName, String sException, Int32 iUserID) +97 PilatesPlusDublin.MainDefault.Page_Load(Object sender, EventArgs e) +144 System.Web.UI.Control.OnLoad(EventArgs e) +99 System.Web.UI.Control.LoadRecursive() +47 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +7350 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +213 System.Web.UI.Page.ProcessRequest() +86 System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +18 System.Web.UI.Page.ProcessRequest(HttpContext context) +49 ASP.maindefault_aspx.ProcessRequest(HttpContext context) +4 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +358 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +64"

If WebPermission isn't available at the hosting site, how do I configure my site to allow access to the page? Is there some tags that need to be put into the web.config? Note - we have no access to machine.config or any other IIS settings.

I understand that people hate reading and answering these types of question but any help on what I, or my hosting site need to do to fix this would be appreciated enormously

Answer 1

Is your web application calling a web service or accessing external web sites? If so, you might need to talk with your hosting provider and ask for the URI to be added to the list of allowed connection endpoints.

Answer 2

I am posting this in case it helps anyone else. Be warned before they move an existing ASP.NET site hosted by your provider to another sever.

MAKE SURE YOU ASK THEM ABOUT WEBPERMISSIONS AND TRUST LEVELS.

This was my providers reply....

"Thank you for your email.

It's failing because WebPermission isn't available in a medium trust environment.

We can't make any changes to these servers at the moment, since we plan to migrate all sites on to a pair of new clusters by the end of this year. I'm confident that the new Windows cluster will have WebPermission available, since it's enabled on the current Namesco Windows cluster. "

So they expect my client's site to be offline and losing business until the New Year.

Answer 3

Hi guys,

Just as an FYI to anyone that might have the same problem - I got this exact error message and couldn't figure out what was wrong since I hadn't changed any settings on my local box.

I realized after a couple minutes that I had accidentally opened the project from a network share on Windows Server 2008. Of course the permissions weren't correct! Really stupid move, but if it helps someone I am willing to be humiliated :)

Answer 4

Not sure if this will help, but I once had a client with the same type of problem. Their webhosting company made some changes, resulting in their website throwing similar kinds of errors. Managed to get things working again by adding the following just inside the System.Web section in web.config:

<trust level="Full" />

If this doesn't solve your problem and the webhosting can't fix things on their until the new year, I'd seriously consider switching hosting providers.