Because the XmlReaderSettings.XmlResolver can contain sensitive information such as user credentials, you should be careful when caching System.Xml.XmlReaderSettings objects, or when passing the System.Xml.XmlReaderSettings object from one component to another.

An System.Xml.XmlSecureResolver can be used to access external documents. The System.Xml.XmlSecureResolver class helps to secure another implementation of System.Xml.XmlResolver by wrapping the System.Xml.XmlResolver object and restricting the resources that the underlying System.Xml.XmlResolver has access to. For more information, see How to: Use the XmlSecureResolver Class.

The System.Xml.Schema.XmlSchemaValidationFlags.ProcessInlineSchema and System.Xml.Schema.XmlSchemaValidationFlags.ProcessSchemaLocation validation flags of an System.Xml.XmlReaderSettings object are not set by default. When these flags are set, the XmlReaderSettings.XmlResolver of the System.Xml.XmlReaderSettings object is used to resolve schema locations encountered in the instance document in the System.Xml.XmlReader. If the XmlReaderSettings.XmlResolver object is null, schema locations are not resolved even if the System.Xml.Schema.XmlSchemaValidationFlags.ProcessInlineSchema and System.Xml.Schema.XmlSchemaValidationFlags.ProcessSchemaLocation validation flags are set.

Schemas added during validation add new types and can change the validation outcome of the document being validated. As a result, external schemas should only be resolved from trusted sources.