title: Security Exception: Request failed
body: <p><a href="http://sextaigreja.com.br/Downloads" rel="nofollow">This page</a> presents a security problem.</p>
  
  <p>Not yet identified the cause of the error.
  This page was listing all the files in a folder, it worked perfectly. Now she is listing these same files, but using ajax.</p>
  
  <p>The code is simple:
  I have a PartialView, which is a WebGrid that lists the files in this folder:</p>
  
  <p><strong>PartialView "_files.cshtml"</strong></p>
  
  <pre><code>@model string[]
  @{
      var folderName = Request["FolderName"];
  
      var columns = new List&lt;WebGridColumn&gt;
                              {
                                  { ... }
                              };
  
      if (Request.IsAuthenticated)
      {
          columns.Add( { ... } );
      }
  
      var grid = new WebGrid(
          source: Model,
          ajaxUpdateContainerId: folderName + "-grid",
          rowsPerPage: 10);
  }
  @grid.GetHtml(columns: columns,
      headerStyle: "grid-header"
  )
  </code></pre>
  
  <p>The request is made by this javascript funciton:</p>
  
  <p><strong>Index.cshtml</strong></p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
      $(window).load(function () {
          loadFiles("Documentos");
      });
  
      function loadFiles(folderName) {
          $.ajax(
                  { type: "GET",
                      url: '/Downloads/Files?folderName=' + folderName,
                      success: function (data) {
                          $("#" + folderName + "-grid").html(data);
                      }
                  })
      }
  &lt;/script&gt;
  
  &lt;div id="Documentos-grid"&gt;&lt;/div&gt;
  </code></pre>
  
  <p><strong>In the Controller, I call PartialView:</strong></p>
  
  <pre><code>public string[] GetFiles(string folderName)
  {
      var locations = Server.MapPath("~/App_Data/Downloads/");
      return Directory.GetFiles(Path.Combine(locations, folderName));
  }
  
  public ActionResult Files(string folderName)
  {
      return PartialView("_files", GetFiles(folderName));
  }
  </code></pre>
  
  <p><strong>The files are sent to the folder</strong>: </p>
  
  <blockquote>
    <p>/App_Data/Downloads/</p>
  </blockquote>
  
  <p>Following <a href="http://www.ironspeed.com/Designer/8.0.2/WebHelp/Part_VI/Security_Exception_AspNetHostingPermission_Error.htm" rel="nofollow">this article</a>, I put a web.config in the Downloads folder, but the error remains.</p>
  
  <p><strong>Web.Config</strong></p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
    &lt;location allowOverride="true"&gt;
      &lt;system.web&gt;
        &lt;securityPolicy&gt;
          &lt;trustLevel name="Full" policyFile="internal" /&gt;
          &lt;trustLevel name="High" policyFile="web_hightrust.config" /&gt;
          &lt;trustLevel name="Medium" policyFile="web_mediumtrust.config" /&gt;
          &lt;trustLevel name="Low" policyFile="web_lowtrust.config" /&gt;
          &lt;trustLevel name="Minimal" policyFile="web_minimaltrust.config" /&gt;
        &lt;/securityPolicy&gt;
        &lt;trust level="Medium" originUrl="" /&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p><strong>Controller</strong></p>
  
  <p><strong>The error happens at line 3 of the method: GetBoletins</strong></p>
  
  <pre><code>private DataContext db = new DataContext();
  
  public IList&lt;Boletim&gt; GetBoletins()
  {
      return (from boletim in db.BoletinsSemanais
              where boletim.Year == DateTime.Now.Year
              orderby boletim.Year, boletim.Week, boletim.Name
              select boletim).Take(5).ToList();
  }
  </code></pre>
  
  <p><strong>Another Assembly</strong></p>
  
  <p><strong>DataContext is a class that is in another assembly.</strong></p>
  
  <pre><code>public class DataContext : DbContext
  {
      public DbSet&lt;Boletim&gt; BoletinsSemanais { get; set; }
  
      public DataContext()
          : base("name=DefaultConnection")
      {
  
      }
  
      protected override void OnModelCreating(ModelBuilder modelBuilder)
      {
          modelBuilder.Conventions.Remove&lt;PluralizingTableNameConvention&gt;();
          base.OnModelCreating(modelBuilder);
      }
  }
  </code></pre>