Why can reflection access protected/private member of class in C#?

Member accessibility is not a security feature. It is there to protect the programmer against himself or herself. It helps implementing encapsulation but it is by no means a security feature.

Reflection is tedious enough to use so that people normally don’t go out of their way to use it to access non-public members. It’s also quite slow. Reflection is normally used in special cases only. However, nothing can protect completely against human stupidity, if someone wants to abuse reflection he can easily do it, but even without the reflection API, they can achieve the same thing (if they’re running in full trust, that is) if they are determined enough.

Leave a Comment