-1

How would the following solution be implemented? Would you need to put this code in each library assembly or just in the main assembly that is determining whether it is safe to call the library assembly based on whether or not it originates from a given intranet Web site? Also, who should call the CheckSite method - each library assembly or the main app? Here is the example and solution from a practice exam for the C# Specialist Exam 70-483 that I am referring to:

You are an application developer for a company. You are creating an application on the company’s Web server that will manipulate confidential data from business partners. The application relies on many library assemblies in the company intranet to complete its work. You are required to verify that every assembly originates from the same intranet Web site. Which code should you use to verify the current assembly originates from the company intranet?

public bool CheckSite () {
    SiteMembershipCondition site = new
        SiteMembershipCondition( “http://intranet.company.com” );
    return site.Check( Assembly.GetCallingAssembly().Evidence );
}
2

1 Answer 1

2

You shouldn't care what website it comes from, you should be using the strong name (i.e. digitally signed) to verify that the dlls is legitimate. Then it doesn't matter where you download it from.

See this MSDN article on how to sign with a strong name

2
  • Strong name signatures are not especially secure, and some use private keys that are public. So an additional signature may be needed. Aug 28, 2014 at 16:36
  • @FrankHileman: But an additional signature does not require that the dll be downloaded from a specific web site.
    – jmoreno
    Aug 28, 2014 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.