Autofac exception - security critical vs level 2 security transparency

Question

I'm updating an older project to use .net 471 instead of 462 and the most recent version of all nuget packages.

I've had a lot of versioning issues to plow through, but I finally got a project that builds.

But, when I execute the programming I get this exception:

System.TypeAccessException: 'Attempt by security transparent method 'Autofac.Integration.WebApi.RegistrationExtensions.RegisterApiControllers(Autofac.ContainerBuilder, System.Reflection.Assembly[])' to access security critical type 'Autofac.Builder.IRegistrationBuilder`3' failed.

Followed by

Assembly 'Autofac.Integration.WebApi, Version=3.0.0.0, Culture=neutral, PublicKeyToken=17863af14b0044da' is marked with the AllowPartiallyTrustedCallersAttribute, and uses the level 2 security transparency model. Level 2 transparency causes all methods in AllowPartiallyTrustedCallers assemblies to become security transparent by default, which may be the cause of this exception.'

That happens when calling:

builder.RegisterApiControllers(ThisAssembly);

Where builder is an Autofac ContainerBuilder.

Question

Like the subject says, it must be some kind of conflict between SecurityCritical and AllowPartiallyTrustedCallersAttribute but I don't know how I've introduced it and what the best action is, so

What's going on and how can I fix this?

Update

Going further on JLe's suggestion, I removed the webapi reference and used webapi2 instead. I got a related error on my logging setup, but since that's not "core functionality" I skipped it for now (I will need to get back to that) to see what I'd get. I get to the browser screen, which gives me this:

Method 'my.namespace.MyController+d__6.MoveNext()' is security transparent, but is a member of a security critical type.

I tried putting [SecurityCritical] on the controller class, but apparently you're not allowed to do async calls in a class with that attribute:

Error CS4031 Async methods are not allowed in an Interface, Class, or Structure which has the 'SecurityCritical' or 'SecuritySafeCritical' attribute.

But I can't fix that, because I'm doing async calls to the backend (NServicebus ESB).

Are you using nuget.org/packages/Autofac.WebApi2 or nuget.org/packages/Autofac.WebApi? — JLe
I'm just guessing, but the Autofac.WebApi2 package is for WebApi2, so I though maybe the old package created some version conflict which lead to your exception. Could you try remove the old one? — JLe
I just tried, but webapi is needed for that RegisterApiControllers and AutofacWebApiDependencyResolver. — Spikee
Have you tried cleaning your solution? The WebApi2 package should contain those as well, version 4.2.0. The actual namespace of it is the same, Autofac.Integration.WebApi even though it's version 2. — JLe
@JLe: Your suggestion about cleaning up the packages ultimately fixed it (by making sure I was using webapi2). Could you write an answer so I can accept it? — Spikee

JLe JLe · Accepted Answer · 2018-11-28T07:38:14

Make sure you're using nuget.org/packages/Autofac.WebApi2 as that one if for WebApi2, and not the older one called just Autofac.WebApi (the namespaces are the same though, Autofac.Integration.WebApi).

Autofac exception - security critical vs level 2 security transparency

1 Answers