I have PasswordRecovery control as follows

<asp:PasswordRecovery ID="PasswordRecovery1" runat="server" UserNameTitleText="">

<MailDefinition BodyFileName="~/ForgotPasswordMail.txt"  From="<my mail id>" Subject="Here is your Password"></MailDefinition>

Problem is, when I complete PasswordRecovery wizard (user name, security question etc) and finally click on Submit, I get following exception. (Dont forget to read the note at the end)

Description: The application attempted to perform an operation not allowed by the security policy.  To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

Source Error:

[No relevant source lines]

[SecurityException: Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.]
   System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet) +0
   System.Security.CodeAccessPermission.Demand() +59
   System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) +684
   System.IO.FileStream..ctor(String path, FileMode mode) +64
   System.Net.Mail.SmtpClient.GetFileMailWriter(String pickupDirectory) +234
   System.Net.Mail.SmtpClient.Send(MailMessage message) +2004
   System.Web.UI.WebControls.LoginUtil.SendPasswordMail(String email, String userName, String password, MailDefinition mailDefinition, String defaultSubject, String defaultBody, OnSendingMailDelegate onSendingMailDelegate, OnSendMailErrorDelegate onSendMailErrorDelegate, Control owner) +341
   System.Web.UI.WebControls.PasswordRecovery.AttemptSendPasswordQuestionView() +653

 Try adding this in your web.config

<system.web>
    <trust level="Full" originUrl="" />
</system.web>

My web host has locked this. I can't change this to full trust. I am assuming the server is configured with medium trust since I can read the file using File.ReadAllText. But IMO trust level should not be really a problem since medium trust allows accessing files from the root path hierarchy and my forgotpasswordmail.txt is on root path.

any comments?

It is clear that PasswordRecovery control uses FileStream to open the MailDefinition file. Looks like for FileStream class to work there are more permissions required than given my Medium trust. If this is correct, then it sounds like a Bug in API. The file being accessed is well inside the security boundaries (under root hierarchy), but cannot access it using FileStream!