U4-3763 - Umbraco 7 and medium trust.

Created by Mike Chambers 29 Nov 2013, 09:45:21 Updated by Sebastiaan Janssen 02 Dec 2013, 16:49:33

After seeing MediumTrust support being dropped and neils comment on the blog...

We looked at the http://stackoverflow.com/a/17218344 and forwarded on to our host - Rackspace. The response from them is that it's less than an official position that medium trust is obsolete..

''"We are aware of the information you have provided. Microsoft is giving mixed guidance as their asp.net hosting deployment guide for .net 4.x says do not run full trust for shared hosting while this documentation states as long as the DACL's are set, it is safe to run Full trust. We continue to work directly with Microsoft on this issue however there has been no final word that this is safe for us."''

I think they are refering to http://www.microsoft.com/en-us/download/details.aspx?id=16591 - asp.net 4.0 hosting deployment guide has

''"Hosters should not use Full trust in shared hosting scenarios. Medium trust is recommended for Web servers that are Internet-facing. When applications run under Full trust, they are fully trusted on the server. Even if they are isolated by process, and even when user rights are limited, applications can access content from other trusted applications, as well as access many system resources, such as the registry and event logs."''

Is it the case that there could be a mediumTrust fork of u7 or are the fullTrust requirements for essential functions? Or maybe v6 will continue to support mediumTrust?

(Isn't it also the case that to be listed in http://www.microsoft.com/web/gallery/ there is a requirement to be medium trust?)


Sebastiaan Janssen 02 Dec 2013, 16:49:26

We don't have the resources to invest any time in medium trust support for v7 (we're just 7 people, not all of which work on the core of Umbraco).

The upgrade instructions for MVC5 also include: "Remove any trust levels other than Full.": http://www.asp.net/mvc/tutorials/mvc-5/how-to-upgrade-an-aspnet-mvc-4-and-web-api-project-to-aspnet-mvc-5-and-web-api-2 This indicates clearly that MS is not putting any more effort in to support medium trust scenarios, supporting the "Medium Trust is obsolete" statement on StackOverflow.

Yes, v6 will keep support for MedTrust as removing that support is a breaking change.

The Web Gallery currently still has a MedTrust requirement indeed and we'll work with Microsoft when it becomes time to get v7 up there. We first want to stabilize v7 for a while before we submit it to the web gallery though.

I hope this helps.

Priority: Normal

Type: Bug

State: Closed


Difficulty: Normal


Backwards Compatible: True

Fix Submitted:

Affected versions: 7.0.0, 7.0.1

Due in version:


Story Points: