Saturday, October 31, 2009

iTextSharp PDF rendering in a medium trust ASP.Net environment

Rendering a PDF for download or email is a very common task for an e-commerce website. One thing to consider when deciding on a PDF library for rendering is what environment the site is running in. Most ASP.Net shared hosting solutions will restrict their hosted sites to Medium trust to prevent a rogue site from peeking at other sites on the server.

Medium trust environments can cause funny things to happen between the development environment and the production environment. By default the websites created in Visual Studio have Full trust, this can cause security problems after deployment if you haven't setup your development environment to mimic production. A good first step is to add a trust level to your web.config system.web section.

    <trust level="Medium" />
This will help to find any trust issues while developing.

So to rendering PDF. After trying ReportViewer 2008 in local mode and PDFSharp (both of which are still very good at rendering PDFs), I have found success with iTextSharp. ReportViewer and PDFSharp both require Full trust mode because they use native COM dlls as part of the GDI rendering process. This makes them unsuitable for shared hosting environments unless you can convince your hoster to raise your site's trust level. The PDFSharp Wiki says that release 1.30 solves most medium trust issues and that full support is in the near future, which is promising. My car also has most of it's wheels, but until I put the fourth one on it isn't going to go far on the road.

iTextSharp appears to have less documentation on the web (one of the best being a fairly comprehensive iTextSharp tutorial), but it is just as powerful as PDFSharp or ReportViewer. The best thing about it though is that it can run in Medium trust mode - once a minor change is made to allow partially trusted callers. To make this change download the iTextSharp source distribution (
Modify the AssemblyInfo.cs file to add the partially trusted callers attribute.
[assembly: AllowPartiallyTrustedCallers()]
Rebuild the iTextSharp assembly and it should be good to go in a Medium trust environment.

kick it on Shout it


Wahab said...

This solution helped me, move one ladder up. But again i got stuck with this issue

Error! Request for the permission of type 'System.Net.WebPermission, System,
Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

Do you have any suggested solution.

Liam said...

Hi Wahab
I'm guessing from the request for System.Net.WebPermission you may be rendering the output of a web page to PDF using iTextSharp.

The WebPermission permission is required when making a network or web service call, such as retrieving a Html page using System.Net.HttpWebRequest. Medium trust generally doesn't allow WebPermission so your application won't be able to make the request for the Html page.

Check in your hosting environment whether this permission is allowed. If it is you can modify your local Medium trust policy to mimic the behavior of your production environment if it is your development environment that is causing problems.

Hope this helps

Karthikeyan Selvaraj said...

Wonderful solution, this helps me to deploy PDF creation in Medium Trust mode. Thank you very much for the solution.

Liam said...

Hi Karthikeyan
Glad to hear that 2this helped you out!

Guy said...

Hi Liam

Thanks for this post. I tried what you suggested, but I have another problem - I get a warning when rebuilding the iTextSharp assembly. On the AssembleyKeyFile statement I am told "use command line option /keyfile or appropriate project settings instead of AssemblyKey File. It does rebuild even with this warning, but then when I try to use the dll in a medium trust environment I still get the error about partially trusted callers. I would greatly appreciate any advice!

Ofrag said...

This Helped LOTS!

Thank for posting this.

Also I got a little hung up on the tutorials, just be sure you know where your new pdfs are flying around to, and don't forget to close them off when your done.


Gavin said...

Hi Liam,

You are a beautiful individual. I have just finished an application using ReportViewer and then realised about the medium trust issue. Hitting the same problem with ItextSharp (after reading that it should work) was a killer. Your post got me up and running and my text version on a shared server is working. Thanks!

Stephen said...
This comment has been removed by the author.
Stephen said...

Hi I just came across to your blog It's quiet informative.Email marketing is one of the most effective forms of advertising for small businesses.But now a days the most important thing is any business is trust online trust.Trust marketing is essentially what you do in marketing that impacts the 'why and how' of marketing. It is not simply doing whatever you want in an effort to raise sales. It takes a long-term 'big picture' approach to marketing where customers are your partners in success.Online Trust

Marco Mugnatto said...


Anonymous said...

Thanks This solved my problem....

Andre said...

I am trying for about 2 weeks to find a solution with level trust medium and I thing I found a solution. But I did not know who to modify the assnmblyinfo.cs and who to recreate a dll of ISharpText. Could you guide my step by step It will be very appreciated. Thank you Andre

Aron said...

I have the same problem, How to modify assemblyinfo.cs as it shows reference error in VS

Sameep Shah said...

Thank Liam..

Solution worked for me..

seriously it helped me a lot..

Once again thank you very much..

Bill Wolfe said...

Thanks so much. Huge help and worked perfect!

Barclay Hughes said...

Accessing a Web-page coding web page using System.Net.HttpWebRequest. Method believe in generally doesn't allow WebPermission so your application won't be able to make the demand for the Web-page coding web page.

Blogger said...

Bluehost is the best hosting company for any hosting services you need.

Blogger said...

WP land - $5/month WordPress hosting.