C#强化系列文章九：代码访问安全性使用
在.Net Framework中提供了代码访问安全性(Code Access Security)，它的主要作用就是限制代码的使用权限。可以控制各种系统资源的访问权限、可以要求代码的调用方拥有特定的权限......。比如我们可以控制自己的dll只能在什么条件下由什么人调用，特别是在Asp.net中可以限制不同代码的安全权限，从源头限制住网络上的攻击等。
本文的主要内容如下：
1、在Asp.Net中使用自定义的信任级别
2、配置Sqlconnection的代码访问权限
3、实现和使用一个最简版的自定义权限
在Asp.Net中使用自定义的信任级别
Asp.Net默认在C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\web.config中配置了网站的信任级别：
< securityPolicy >
< trustLevel name =\ policyFile =\
< trustLevel name =\ policyFile =\
< trustLevel name =\ policyFile =\ < trustLevel name =\ policyFile =\
< trustLevel name =\ policyFile =\
< trust level =\ originUrl =\
默认为Full，表示拥有最大的权限，当然风险也就最高，我们可以在自己的网站下的web.config中自定义信任级别：
< securityPolicy > < trustLevel name =\ policyFile =\
< trust level =\ originUrl =\
这里使用了自定义的配置文件，其实也就是复制C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\web_lowtrust.config文件，然后在此文件上进行适当修改就可以了(使用此配置默认是不允许连接数据库的 )
配置Sqlconnection的代码访问权限
配置的方法就是修改自定义的web_customtrust.config文件，修改后的文件如下所示：粗体
部分为修改点
web_customtrust.config < configuration > < mscorlib > < security > < policy >
< PolicyLevel version =\ < SecurityClasses >
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\ < SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\ < SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\PublicKeyToken=b77a5c561934e089\
< SecurityClass Name =\ Description =\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\
< NamedPermissionSets > < PermissionSet
class =\ version =\
Unrestricted =\ Name =\
Description =\ /> < PermissionSet
class =\ version =\
Name =\
Description =\ /> < PermissionSet
class =\ version =\
Name =\
< IPermission
class =\ version =\ Level =\ /> < IPermission
class =\ version =\
Read =\
PathDiscovery =\ /> < IPermission
class =\ version =\
Allowed =\ UserQuota =\ /> < IPermission
class =\ version =\
Flags =\ />
< IPermission class =\ version =\
< add ConnectionString =\
KeyRestrictions =\ KeyRestrictionBehavior =\
< CodeGroup
class =\ version =\
PermissionSetName =\ < IMembershipCondition
=\ class =\ version =\ /> < CodeGroup
class =\ version =\
PermissionSetName =\ < IMembershipCondition
class =\ version =\
Url =\ /> < CodeGroup
class =\ version =\
PermissionSetName =\ < IMembershipCondition
class =\ version =\
Url =\ />
< CodeGroup class =\ version =\ PermissionSetName < IMembershipCondition
class =\ version =\
Zone =\ /> < CodeGroup
class =\ version =\
PermissionSetName =\ Name =\
Description =\
strong name full trust. \
< IMembershipCondition
class =\ version =\ PublicKeyBlob
=\ED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293\ /> < CodeGroup
class =\ version =\
PermissionSetName =\ Name =\
Description =\code group grants code signed with the ECMA strong name full trust. \
< IMembershipCondition
class =\ version =\
PublicKeyBlob =\ />
加入以上的配置后限制使用SqlConnection时只能访问dbserver上的db1数据库，不能访问其他数据库，用户名密码等可以自由输入，也就是在代码中只能：
SqlConnection connection = new SqlConnection( \data source=dbserver;User ID=gspring;Password=***;initial catalog=db1 \ 如果连接其他数据库就会报错：
说明: 应用程序试图执行安全策略不允许的操作。要授予此应用程序所需的权限，请与系统管理员联系，或在配置文件中更改该应用程序的信任级别。 异常详细信息: System.Security.SecurityException: 请求“System.Data.SqlClient.SqlClientPermission, System.Data, Version = 2.0 . 0.0 , Culture = neutral, PublicKeyToken = b77a5c561934e089”类型的权限已失败。