XPO in a Medium Trust Environment

The benefits of this technology are discussed elsewhere, but there's no doubt that XPO can, and should, be used in ASP.NET web applications. However, when deploying applications onto external web hosting servers, the code security configuration can, and often does, create problems.

The key problem is that the majority of web host servers run ASP.NET in so-called Medium Trust mode. This is a specialised configuration that restricts what resources and what functions an application is permitted to perform.

This is not unreasonable. In most hosting environments, your web site isn't the only site operating on a particular server and the hosting company has a duty to protect your site from malicious code potentially loaded on a co-located site. As a result the system is locked down and limited in what it is allowed to do.

With the latest release of XPO (Version 2), DevExpress have made significant advances in how the code operates and in particular they have introduced a couple of switches that should allow your application to run properly in the restricted environment of a web host.

Switches

These relevant switches are listed below:

XpoDefault.UseFastAccessors	true if XPO uses its internal mechanism to create new instances of persistent classes, and to set and retrieve object property values; false, to use the Reflection.
XpoDefault.CacheBehaviour	CacheBehaviour.Strong reduces the performance of the system but allows it to run under Medium Host environments.

These switches are found on the XpoDefault static class which define the configuration for the whole application.

Configuration

So to run XPO in a Medium Trust environment the following calls should be made prior to instantiating a Session:

XpoDefault.UseFastAccessors = 
            false;

            XpoDefault.CacheBehavior = CacheBehavior.Strong;

Further Issues

In the majority of cases, the above settings should allow XPO to run on an external host. However, some hosts refine their code security model and this can still create problems. If you have the appropriate subscription, DevExpress include the source code and you are able to make changes.