What are the security protection skills of .NET Framework?
This article will explain in detail about the .NET Framework security protection skills, the content of the article is of high quality, so the editor will share it with you for reference. I hope you will have some understanding of the relevant knowledge after reading this article.
As a developer,. NET Framework is a very powerful application. However, although the function is powerful, its security still needs our attention. It's easy to set aside some time to learn something after heavy development tasks. Found that there are several examples of System.Security content in the machine, this namespace has never been used before, just to learn about it. Because it is not a systematic study, it is not well organized. After thinking about it, let's take the. NET Framework security protection example to illustrate.
.net Framework Security 1. Set permissions
[FileIOPermission (SecurityAction.
Demand, Write= "C:\\ temp.txt")]
Public class App:
System.Windows.Forms.Form
{
/ / slightly
}
FileIOPermissionAttribute is defined in System.Security.Permissions. It inherits from SecurityAttribute, and in this case, you must have write permission to the C:\ temp.txt file when using the App class.
There is a paragraph about security requirements in the .net framework documentation: "to ensure that only callers who have been granted a specified permission can call your code, you can declare or enforce that the caller of your code has a specific permission or permission set. Requires the runtime to perform a security check to impose restrictions on the calling code. During the security check, the runtime traverses the call stack, checks the permissions of each caller in the stack, and then determines whether the requested permissions have been granted to each caller. If it is found that a caller does not have the required permissions, the security check fails and a SecurityException is thrown. "
In the example, permissions appear declaratively. SecurityAction.Demand can act on a class or method, in this case on a class. Write is one of the attributes of FileIOPermission, and other commonly used properties are Read, Append, All, and so on.
There are also some values in the SecurityAction enumeration that act on assembly. For example, the following example:
[assembly:SecurityPermission
(SecurityAction.RequestMinimum
UnmanagedCode=true)]
SecurityAction.RequestMinimum is the minimum permission for a request to run. This line requires that the assembly allow calls to unmanaged code.
In addition to declarative methods, mandatory methods can also be used. The code is as follows:
FileIOPermission filePerm =
New FileIOPermission (FileIO
PermissionAccess.AllAccess
"C:\\ temp.txt")
Try
{
FilePerm.Demand ()
/ / Code to access file goes here
}
Catch (SecurityException excep)
{
MessageBox.Show (excep.Message)
Return
}
.net Framework Security II. User role Management
The management of users and their roles is used in many programs. Today, asp.net 2.0 has greatly enhanced this aspect, and developers don't need to know much about technology to make great applications. However, for Windows Form applications, there are many areas that need to be set by programmers themselves.
Assuming that we already know userName and the roles to which it belongs, we can set the Principal of the current thread like this:
GenericIdentity genIdent =
New GenericIdentity (userName)
GenericPrincipal genPrin =
New GenericPrincipal
(genIdent, roles)
Thread.CurrentPrincipal =
GenPrin
Then we have three ways to validate the user's role.
* the GenericPrincipal.IsInRole method is used:
GenericPrincipal currentPrin =
Thread.CurrentPrincipal as
GenericPrincipal
If (currentPrin! = null & &
CurrentPrin.IsInRole ("Manager"))
{
/ / slightly
}
The second method is to use the PrincipalPermission class, which is similar to the enforcement method in permission settings:
PrincipalPermission prinPerm =
New PrincipalPermission
(null, "Manager")
Try
{
PrinPerm.Demand ()
/ / do something
}
Catch
{
/ / error handling
}
The third method is similar to the declaration in permission settings:
Private void DecPermButton_Click
(object sender, System.EventArgs e)
{
Try
{
PerformManagerAction ()
/ / do something
}
Catch
{
/ / error handling
}
}
[PrincipalPermission
(SecurityAction.Demand
Role= "Manager")]
Void performManagerAction ()
{
}
Net Framework security skills are shared here, I hope the above content can be of some help to you, you can learn more knowledge. If you think the article is good, you can share it for more people to see.
