.NET Framework Security

Summary

Because the .NET Framework assigns trust to code and not users, evidence about code is a fundamental piece of .NET Framework security. Evidence can be viewed as the credentials for .NET Framework code. Generally, the same .NET application will have the same evidence, regardless of which user executes it.

Evidence is applied to assemblies and app domains. The Common Language Runtime provides default evidence when assemblies are loaded. Hosts can provide evidence for both assemblies and app domains, and assemblies can also provide evidence about themselves. However, assembly evidence does nothing unless security policy recognizes and uses it. Unmanaged hosts can only provide evidence regarding app domains, while managed hosts can provide ...