title: Why would a .net web app need to check if the public key of the name of the CALLING assembly has the same length as the EXECUTING assembly's?
body: <p>An old .NET web app I inherited  is littered with an odd "assembly security check": it checks that the public key of the name of the <em>calling</em> assembly has the same length as the public key of the name of the <em>executing</em> assembly.</p>
  
  <p>The calls look like this:</p>
  
  <pre><code>CheckAssembly(System.Reflection.Assembly.GetCallingAssembly(), System.Reflection.Assembly.GetExecutingAssembly(), this);
  </code></pre>
  
  <p>...and that method is:</p>
  
  <pre><code>public static void CheckAssembly(Assembly callingAssembly, Assembly executingAssembly, object useObject)
      {
          byte[] assemblyPublicKey = executingAssembly.GetName().GetPublicKey();
          byte[] callingPublicKey = callingAssembly.GetName().GetPublicKey();
          if (callingPublicKey == null || assemblyPublicKey.Length != callingPublicKey.Length)
          {
              throw new SecurityException("The calling assembly does not have permission to use objects of type '" + useObject.GetType().FullName + "'");
          }
          for (int i = 0; i &lt; assemblyPublicKey.Length; i++)
          {
              if (assemblyPublicKey[i] != callingPublicKey[i])
              {
                  throw new SecurityException("The calling assembly does not have permission to use objects of type '" + useObject.GetType().FullName + "'");
              }
          }
      }
  </code></pre>
  
  <ol>
  <li><p>I think it's checking if it's assemblies (DLL files) have not been swapped or modified or anything. Is that correct? If not, what is this code doing? Any guesses as to why it would have been written?</p></li>
  <li><p>I thought the .net framework would do this anyway, if it's needed. Right?</p></li>
  <li><p>Maybe this is old code from when the app was a winforms app and not a web app? Since it's a web app, we have complete control over what DLLs are on the server, so no security risk, correct?</p></li>
  </ol>
  
  <p>(Can provide further info if needed).</p>