CA2103: Review imperative security
| Item | Value |
|---|---|
| RuleId | CA2103 |
| Category | Microsoft.Security |
| Breaking change | Breaking |
Cause
A method uses imperative security and might be constructing the permission by using state information or return values that can change as long as the demand is active.
Note
This rule has been deprecated. For more information, see Deprecated rules.
Rule description
Imperative security uses managed objects to specify permissions and security actions during code execution, compared to declarative security, which uses attributes to store permissions and actions in metadata. Imperative security is flexible because you can set the state of a permission object and select security actions by using information that is not available until run time. Together with that flexibility comes the risk that the run-time information that you use to determine the state of a permission does not remain unchanged as long as the action is in effect.
Use declarative security whenever possible. Declarative demands are easier to understand.
How to fix violations
Review the imperative security demands to make sure that the state of the permission does not rely on information that can change as long as the permission is being used.
When to suppress warnings
It is safe to suppress a warning from this rule if the permission does not rely on changing data. However, it is better to change the imperative demand to its declarative equivalent.