title: Is “Code Access Security” of any real world use?
body: <h1>Warning:</h1>
  
  <p>Newer versions of .Net and .Net core has have removed and/or changed “Code Access Security” (CAS) since this question was asked.</p>
  
  <h1>Original Question:</h1>
  
  <p>I am in the process of studying for the <a href="http://www.microsoft.com/learning/en/us/Exam.aspx?ID=70-536&amp;Locale=en-us" rel="nofollow noreferrer">70-536 .NET Framework - Application Development Foundation Exam</a>, as I have been programming .net for many years, this should not be hard!</p>
  
  <p>However I am having to learn about “Code Access Security” (CAS),  As I have never had a need to use or configure it, I was wondering if anyone else has found a real life usage for it?</p>
  
  <p>Please provide examples of when you have used CAS and it has been part of the solution rather then the problem.</p>
  
  <p>(So far everything else has had some relationship to task I have had to do in my years of .NET programming)</p>
  
  <hr>
  
  <p><strong>Related questions:</strong></p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/420854/why-to-use-cas-code-access-security">Why to use CAS (Code Access Security)?</a> - This has very few real world examples apart from how Microsoft uses it.</li>
  <li><a href="https://stackoverflow.com/questions/170844/anyone-really-using-code-access-security-to-protect-their-assemblies-and-or-metho">Anyone really using Code Access Security to protect their assemblies and/or methods?</a></li>
  <li><a href="https://stackoverflow.com/questions/737995/what-is-code-access-security-in-net">What is Code Access Security in .NET</a> - Defines CAS well, but does not give real examples.</li>
  <li>.<a href="https://stackoverflow.com/questions/1047243/net-code-access-security-useful-or-just-overcomplicated">NET Code Access Security: Useful or just overcomplicated?</a></li>
  </ul>
  
  <hr>
  
  <p><strong>Results so far.</strong></p>
  
  <ul>
  <li><p>CAS is useful when you are hosting 3rd party code.  E.g. a web hosting company can use it to stop their customer's Asp.net code doing damage to the servers.  (Office also make use of it when .NET is used as a replacement for VBA)</p></li>
  <li><p>The only detailed example of it being used outside of a Microsoft application so far are:</p>
  
  <blockquote>
    <p>A recent project I did had something
    similar: allow the user to upload a
    library, and test it for performance
    ("who makes the best algorithm").
    Needless to say, we needed CAS heavily
    there.</p>
  </blockquote></li>
  <li><p>CAS seems to be useful to get JITDC certification, that is like by the US department of defence, however I don’t know if CAS was of any real value, or if it was just box ticking.</p></li>
  </ul>
  
  <p>(If you need to bypass a host that uses CAS and you have admin rights on them machine, you can just put your assemblies in the GAC.)</p>
  
  <p>Looking forward, <a href="http://blogs.msdn.com/shawnfa/archive/2009/05/21/security-policy-in-the-v4-clr.aspx" rel="nofollow noreferrer">CAS is a bit less complex in .net 4</a>. </p>
  
  <hr>
  
  <p>At least it looks like the new Microsoft exams will not have a “foundation” exam that includes CAS.  I don’t know if it will make it into the new Winforms/WPF exams.</p>