I have been stuck in the middle of a module developer and a hosting company. I purchased a store module and have been unable to get it to work. Developer says it is the hosts fault because of a security setting. Host says they will not change security level.

The setting in question is SerializationFormatter in server.config.

My questions:
Does DNN need SerializationFormatter added to the server.config to run properly?
Should the host have SerializationFormatter or does this pose risks to the server?
Do most hosts have SerializationFormatter included in server.config?

My hosts server.config has the following settings:

<IPermission class="SecurityPermission"
version="1" Flags="Assertion, Execution, ControlThread, ControlPrincipal, RemotingConfiguration"/>

Software developer says the server.config should be:

<IPermission class="SecurityPermission" version="1"
Flags="Assertion, Execution, ControlThread, ControlPrincipal,RemotingConfiguration,SerializationFormatter"/>

I had the same issue with Medium Trust and binary serialization when I first developed the EventQueue.

What I ended up doing was writing all the the serialization of the EventQueue objects manually, which turned out to be better for performance anyway.

It's kind of ironic that I was able to keep the EventQueue working in Medium Trust by persisting stateful objects this way, but I'm sure it's not the first time.
BTW, the EventQueue does have an overload to encrypt the message before sending it to the queue if anyone is worried about the information being passed.

Anyway, you might tell the developer that there is a way around this issue, and the code in the EventQueue is pretty straight forward for serializing an object into XML, and deserializing it back to an object.

---