Edit

Share via

SYSLIB0003: Code access security is not supported

  • Article

Code access security (CAS) is an unsupported, legacy technology. The infrastructure to enable CAS, which exists only in .NET Framework 2.x - 4.x, is deprecated and not receiving servicing or security fixes.

As a result, most code access security (CAS)-related types in .NET are obsolete, starting in .NET 5. This includes CAS attributes, such as SecurityPermissionAttribute, CAS permission objects, such as SocketPermission, EvidenceBase-derived types, and other supporting APIs. Using these APIs generates warning SYSLIB0003 at compile time.

The complete list of obsolete CAS APIs is as follows:

Workarounds

  • If you're asserting any security permission, remove the attribute or call that asserts the permission.

    // REMOVE the attribute below.
[SecurityPermission(SecurityAction.Assert, ControlThread = true)]
public void DoSomething()
{
}
public void DoAssert()
{
    // REMOVE the line below.
    new SecurityPermission(SecurityPermissionFlag.ControlThread).Assert();
}

  • If you're denying or restricting (via PermitOnly) any permission, contact your security advisor. Because CAS attributes are not honored by the .NET 5+ runtime, your application could have a security hole if it incorrectly relies on the CAS infrastructure to restrict access to these methods.

    // REVIEW the attribute below; could indicate security vulnerability.
[SecurityPermission(SecurityAction.Deny, ControlThread = true)]
public void DoSomething()
{
}
public void DoPermitOnly()
{
    // REVIEW the line below; could indicate security vulnerability.
    new SecurityPermission(SecurityPermissionFlag.ControlThread).PermitOnly();
}

  • If you're demanding any permission (except PrincipalPermission), remove the demand. All demands will succeed at run time.

    // REMOVE the attribute below; it will always succeed.
[SecurityPermission(SecurityAction.Demand, ControlThread = true)]
public void DoSomething()
{
}
public void DoDemand()
{
    // REMOVE the line below; it will always succeed.
    new SecurityPermission(SecurityPermissionFlag.ControlThread).Demand();
}

  • If you're demanding PrincipalPermission, consult the guidance for SYSLIB0002: PrincipalPermissionAttribute is obsolete. That guidance applies for both PrincipalPermission and PrincipalPermissionAttribute.

Suppress a warning

If you must use the obsolete APIs, you can suppress the warning in code or in your project file.

To suppress only a single violation, add preprocessor directives to your source file to disable and then re-enable the warning.

// Disable the warning.
#pragma warning disable SYSLIB0003

// Code that uses obsolete API.
// ...

// Re-enable the warning.
#pragma warning restore SYSLIB0003

To suppress all the SYSLIB0003 warnings in your project, add a <NoWarn> property to your project file.

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
   ...
   <NoWarn>$(NoWarn);SYSLIB0003</NoWarn>
  </PropertyGroup>
</Project>

For more information, see Suppress warnings.

See also