Should I worry about the safety of my application if it runs in Full Trust level?
If yes, why? What damages could be done?
If the trust level should be a concern why it is the default level for asp.net applications instead of medium?
I know all the yes and no's between medium and full trust levels, but I can't see where this could be a serious risk to the application and server.
My ISP wants to (and will) change the trust level to Medium of an IIS asp.net mvc application running on a dedicated server. This simply will break my application, since it relies heavily on
System.Reflection namespace and it uses 3rd party assemblies which don't have the
The application runs under a specific user that has read only access to the application directory and only execute permission on stored procedures on the Sql Server. The authentication is via SSPI, so no passwords on web.config.
The ISP claims that if they let my application run in full trust they can not guarantee the security of my server. I never heard about a single case when the full trust was the cause to a security break. It seems to me that they are not sure about what they are doing.
I can't see a security flaw here. The only securiy flaw I can see in general is the password stealing from the web.config, but this is not possible in my current setup...