WebAPI OData 5.0 Beta - Accessing GlobalConfiguration throws Security Error

Question

I recently installed the pre-release version of the WebApi OData 5.0 framework to play with the new $expand support. Everything built okay, but I get a strange exception on App_Start.

Attempt by security transparent method
'System.Web.Http.GlobalConfiguration.get_Configuration()' 
to access security critical type 'System.Web.Http.HttpConfiguration' failed.

Source Error:

Line 12:    protected void Application_Start()
Line 13:    {
Line 14:        WebApiConfig.Register(GlobalConfiguration.Configuration); // <--
Line 15:    }

Stack Trace:

[TypeAccessException: Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.Http.GlobalConfiguration.get_Configuration() +0
   API.WebApiApplication.Application_Start() in Global.asax.cs:14

[HttpException (0x80004005): Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app) +12863325
   System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) +175
   System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) +304
   System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) +404
   System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) +475

[HttpException (0x80004005): Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +12880068
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +159
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +12721257

Google reveals very little.

S. Ravi Kiran S. Ravi Kiran · Accepted Answer · 2013-09-09T14:12:44

Run following commands in Package manager Console, in the given order:

Uninstall-Package Microsoft.AspNet.Mvc.FixedDisplayModes
Update-Package Microsoft.AspNet.Mvc -Pre
Update-Package Microsoft.AspNet.WebApi -Pre
Update-Package Microsoft.AspNet.WebApi.Tracing

Now, apply following changes to web.config:

In the Web.config of your project, update value of app setting webpages:version to 3.0.0.0
Under the section runtime in the web.config, check version of each assembly configured and update it to the version of assembly added to your project. Following is the updated configuration in my web.config:

<runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="1.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="EntityFramework" publicKeyToken="b77a5c561934e089" />
<bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="0.0.0.0-1.3.0.0" newVersion="1.3.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
</dependentAssembly>
</assemblyBinding>
</runtime>

Open the web.config from Views folder. There are three things to be updated here:

Under configSections, update versions of the Razor assemblies as 3.0.0.0.
Update version of host under system.web.webPages.razor section, update version of System.Web.Mvc.MvcWebRazorHostFactory as 3.0.0.0.
There are a few version numbers mentioned under pages section of System.web. Update all of them to version 5.0.0.0

If you have Web API Help Pages installed, check for the above assembly configurations there as well.

WebAPI OData 5.0 Beta - Accessing GlobalConfiguration throws Security Error

4 Answers