In case of sharepoint 2010 is it really better to avoid deploying DLLs to the GAC (this has risks because of security override), instead deploying it to the web application IIS bin directory and use custom CAS policies?

In the 2nd case setting CAS policies are bit difficult & to be done carefully.

which is better approach?


This entirely depends on what you are trying to accomplish with your solution. If you need this code to run fully trusted, the GAC is the simpler choice. However, if you don't require full trust on the assembly and want to be more restrictive in what the assembly can do, go the bin route. MSDN has a good description of each path (for 2007 but still relevant): http://msdn.microsoft.com/en-us/library/ms521365(v=office.12).aspx

One note that I would make is that SharePoint itself doesn't run all its code fully trusted. For instance the Microsoft.SharePoint.ApplicationPages assembly (the code behind for most of the _layouts pages) runs under WSS_Minium trust.

Also, if this code is only for your own organization, it really just depends on your coding practices within your organization. However, if this is code for distribution outside of your organization, I would go for the least amount of trust you need for your solution to run. This usually makes server admins happier. And if the code ends up on hosted services (like SharePoint Online), they usually make you justify higher trust levels.


In addition to Johns points, be aware that GAC code runs faster, as it does not have to make stack walk to determine missing permissions.

If you are one of several teams supplying code to the solution, it could be a security issue running in the GAC, as you would be able to execute each other classes/methods. Using CAS policies you can lock the assembly down by setting a specific security policy for that one assembly, but as you say yourself, determining correct policies that is needed and decorating the code with appropriate attributes are difficult and time consuming, both when deploying and forward managing the code.

If you see no direct security issues i usually recommend using GAC for the above reasons

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.