Do ASP.net MVC5 apps require Full trust on IIS10?
-
I have an ASP.net MVC5 app publish on a host provider. CAS trust level is FULL and app runs fine. I want to move the app to another host but they only sport CAS Trust level High and below. I found this reference earlier: "ASP.NET MVC 5 does not support running in anything other than full trust. Microsoft have provided guidance for hosters to move away from using CAS trust levels and use proper OS-level isolation instead." and forwarded it to the new provider. They responded that they are running IIS10 and Windows Server 2019 and the statement above does not apply. Could someone please answer definitively as to whether ASP.Net MVS5 apps require FULL Trust level on IIS10/Server 2019? Current link to source would be appreciated.
-
I have an ASP.net MVC5 app publish on a host provider. CAS trust level is FULL and app runs fine. I want to move the app to another host but they only sport CAS Trust level High and below. I found this reference earlier: "ASP.NET MVC 5 does not support running in anything other than full trust. Microsoft have provided guidance for hosters to move away from using CAS trust levels and use proper OS-level isolation instead." and forwarded it to the new provider. They responded that they are running IIS10 and Windows Server 2019 and the statement above does not apply. Could someone please answer definitively as to whether ASP.Net MVS5 apps require FULL Trust level on IIS10/Server 2019? Current link to source would be appreciated.
Your new hosting providers are idiots. Take your business elsewhere. Just because the linked support article doesn't explicitly mention IIS10, that doesn't mean it "does not apply"; it means it applies to everything from IIS 6.0 (Windows Server 2003 SP2) onwards. Unsurprisingly, Microsoft don't go back and update every article written for one version of Windows every time a new version of Windows is released, just to add "still applies to Windows x.x". CAS has been deprecated since 2009 / .NET Framework 4.0: Enabling CAS Policy Compatibility Mode for a Project - .NET Blog[^]
<NetFx40_LegacySecurityPolicy> Element - .NET Framework | Microsoft Learn[^]:
Code Access Security (CAS) has been deprecated across all versions of .NET Framework and .NET. Recent versions of .NET do not honor CAS annotations and produce errors if CAS-related APIs are used. Developers should seek alternative means of accomplishing security tasks.
The fact that your new hosting company are still using "security" techniques that have been deprecated for at least 15 years should have you extremely worried!
"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer
