WebAPI OData 5.0 Beta - Accessing GlobalConfiguration throws Security Error

Question

I recently installed the pre-release version of the WebApi OData 5.0 framework to play with the new $expand support. Everything built okay, but I get a strange exception on App_Start.

Attempt by security transparent method
'System.Web.Http.GlobalConfiguration.get_Configuration()' 
to access security critical type 'System.Web.Http.HttpConfiguration' failed.

Source Error:

Line 12:    protected void Application_Start()
Line 13:    {
Line 14:        WebApiConfig.Register(GlobalConfiguration.Configuration); // <--
Line 15:    }

Stack Trace:

[TypeAccessException: Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.Http.GlobalConfiguration.get_Configuration() +0
   API.WebApiApplication.Application_Start() in Global.asax.cs:14

[HttpException (0x80004005): Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app) +12863325
   System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) +175
   System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) +304
   System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) +404
   System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) +475

[HttpException (0x80004005): Attempt by security transparent method 'System.Web.Http.GlobalConfiguration.get_Configuration()' to access 
security critical type 'System.Web.Http.HttpConfiguration' failed.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +12880068
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +159
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +12721257

Google reveals very little.

Answer 1

Run following commands in Package manager Console, in the given order:

Uninstall-Package Microsoft.AspNet.Mvc.FixedDisplayModes
Update-Package Microsoft.AspNet.Mvc -Pre
Update-Package Microsoft.AspNet.WebApi -Pre
Update-Package Microsoft.AspNet.WebApi.Tracing

Now, apply following changes to web.config:

1. In the Web.config of your project, update value of app setting webpages:version to 3.0.0.0

2. Under the section runtime in the web.config, check version of each assembly configured and update it to the version of assembly added to your project. Following is the updated configuration in my web.config:

   <runtime>
   <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
   <dependentAssembly>
   <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
   <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
   <bindingRedirect oldVersion="1.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
   <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="EntityFramework" publicKeyToken="b77a5c561934e089" />
   <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
   <bindingRedirect oldVersion="0.0.0.0-1.3.0.0" newVersion="1.3.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
   <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
   </dependentAssembly>
   <dependentAssembly>
   <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />
   <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
   </dependentAssembly>
   </assemblyBinding>
   </runtime>

Open the web.config from Views folder. There are three things to be updated here:

1. Under configSections, update versions of the Razor assemblies as 3.0.0.0.

2. Update version of host under system.web.webPages.razor section, update version of System.Web.Mvc.MvcWebRazorHostFactory as 3.0.0.0.

3. There are a few version numbers mentioned under pages section of System.web. Update all of them to version 5.0.0.0

If you have Web API Help Pages installed, check for the above assembly configurations there as well.

Answer 2

I was having this same error. I just tweaked Ravi's answer a little bit and found that updating the WebApi package follwed by updating/installing WebApi.OData 5.0.0-rc1 package worked well enough for me. I just ran these at the package manager:

Update-Package Microsoft.AspNet.WebApi -Pre
Install-Package Microsoft.AspNet.WebApi.OData -Version 5.0.0

I'm guessing that the prerelease versions of WebApi.OData package has some dependency with a newer version of WebApi package that Nuget fails to inspect as a dependency. Then again, I am technically a newbie with WebApi OData and don't know much about the packages yet but, yeah, I can run the project with $expand and $select functionality and none of the GlobalConfiguration error. :)