ASP.net MVC4 WebAPI JSON中等信任

Question

So, I've been playing with ASP.net MVC4 and the new WebAPI the past few days. One of the first things I always do when starting a new app is throw <trust level="Medium" /> into my Web.config so I can be sure my app will run on most hosts.

Usually, if I use the stock Microsoft stuff everything works without a problem. But tonight I was having problems following Brad Wilson's Webstack of Love presentation . All of my AJAX calls were returning a Server 500 error. However, when I would hit the WebAPI directly in the browser, it would return everything in XML format.

So I assume the serialization to JSON withing the WebAPI controller is what is causing the issue. My question is how to work around this?

It bothers me that Microsoft teaches shared hosts to play it safe and lock things down to Medium Trust, then creates new web technology that won't work in Medium Trust. Maybe everything will be fine when it is a final release and the binaries are installed in the GAC? It can take months for shared hosts to upgrade to the latest and greatest.

It seems like the biggest problem is usually Reflection--90%+ of the stuff I've tried that won't run on Medium Trust is due to this (For instance, I'd love to use AutoMapper instead of hand-coding ViewModel => Entity mappings). Is there a way to confine Reflection to the assemblies within an app so it can become part of the Medium Trust feature set and make this problem a thing of the past?

---

I set up Failed Request Tracing on IIS when I found that the Application_Error event wasn't even firing in my Global.asax. This is the exception being thrown. Not sure how to get any more details.

Warning -MODULE_SET_RESPONSE_ERROR_STATUS 
ModuleName ManagedPipelineHandler 
Notification 128 
HttpStatus 500 
HttpReason Internal Server Error 
HttpSubStatus 0 
ErrorCode 0 
ConfigExceptionInfo
Notification EXECUTE_REQUEST_HANDLER
ErrorCode The operation completed successfully. (0x0)

---

Link to sample project displaying the issue . Also enclosed in the base "Test" directory are screenshots of my fiddler tests: XML-fiddle.png & JSON-fiddle.png.

Answer 1

Web API works just fine in medium trust. Also, since RC version, it 's not deployed to GAC anymore. You can just xcopy Web API dlls onto the server and reference them (or simply just publish your project from VS or git publish it if your host support it, like Azure).

You mention web stack of love. Well, it is SignalR that doesn't work in medium trust mode. See here - according to David Folwer, it won't anytime soon https://github.com/SignalR/SignalR/issues/364

Finally, if you are getting error 500s always add this to Global.asax

 GlobalConfiguration.Configuration.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always;

to receive verbose errors.

Answer 2

My problem had to do with the serializing of Entities with circular relationships (in this case Countries => States, State => Country). The JSON serializer was unable to handle this which led to a 500 error when requesting JSON.

I often use Entities directly for mocking things up and getting a prototype. I always planned on using distinct View Models anyway, but I wanted to understand what was going on and why it was failing.

Kiran Challa's answer in my ASP.net forums question helped me get the error that was occuring: "The RelationshipManager object could not be serialized. This type of object cannot be serialized when the RelationshipManager belongs to an entity object that does not implement IEntityWithRelationships."

That then led me to the Serializing Circular References with JSON.Net and Entity Framework on johnnycode.com.