Why does Azure Web Role work by default in Full Trust?

Question

When I create an Azure ASP.NET application, the default .NET trust level is Full trust by default. I always change it to a partial trust in Windows Azure, which is similar to the average trust level of ASP.NET.

This can be done either through the graphical user interface when you select Properties in Role, or set the enableNativeCodeExecution parameter to false in the definition file (.csdef), as shown below:

<WebRole name="ServiceRuntimeWebsite" enableNativeCodeExecution="false">

As a security developer, I want to run my application in partial trust mode by default, which provides a higher level of security. If I need to use something like Reflection or P / Invoke as a developer, I want to decide to lower this level of trust myself.

I am sure that there is a reason Microsoft decided to use Full trust as the standard .NET trust level, I just do not see it. If you know the reason or think you know it, let me know.

Answer 1

Full trust is required not only to display P / Invoke for .NET. As a result, almost all moderate-sized applications require full trust, because almost all common libraries need it (NHibernate, for example). In fact, I asked the exact opposite question on the Azure forums.

Answer 2

, . / "" , .

, - Azure ( 2012 ) Wordpress Umbraco, - , . , , , . -, , () -, .

, - , Log4Net StructureMap, , . Ergo, - Azure ( "" ), "" , .

Answer 3

, , ( ) .NET-, .

(, CAS.NET)

Answer 4

Because the Medium Trust is now officially out of date. If you are starting a new web project in Visual Studio, it already requires full trust (and partial trust does not work). Microsoft says: don't rely on Medium Trust, use Full Trust instead and isolate untrusted applications across application pools.

Sources:

Column response: Quoted response ASP.NET command

Microsoft: ASP.NET partial trust does not guarantee application isolation

Microsoft: ASP.NET Web Development Best Practices