Return to
HomePage
ASPNET2SecurityFAQs

---

Question: How can I retain impersonation in the new thread created from ASP.NET application?

Answer:

In .NET Framework 1.1, impersonation tokens did not automatically flow to newly created threads. This situation could lead to security vulnerabilities because new threads assume the security context of the process. In .NET Framework 2.0, by default the impersonation token still does not flow across threads, but for ASP.NET applications you can change this default behavior with appropriate configuration of the ASPNET.config file in the %Windir%Microsoft.NET\Framework\{Version Number\ directory.
If you need to flow the impersonation token to new threads, set the enabled attribute to true on the alwaysFlowImpersonationPolicy element and enabled attribute to false on legacyImpersonationPolicy element.in the ASPNET.config file, as shown in the following example.

		 <configuration>
		  <runtime>
		    [<alwaysFlowImpersonationPolicy] enabled="true"/>
		    [<legacyImpersonationPolicy] enabled="false"/>
		  </runtime>
		 </configuration>
	

If you need to prevent impersonation tokens from being passed to new threads programmatically, you can use the ExecutionContext.SuppressFlow method.

---

Return to
HomePage
ASPNET2SecurityFAQs