Web Development

23-Sep-02 3:07

Hello!
I need to share some information (username, password) between pages (to submit them to calls to a web service). Now the Session object is individual for each page and I don't think it is a good idea to transfer the username and password etc. in the Url (like mypage.aspx?userName=""&password="").
So is there any possibility to share such information between different pages of my app?

Cheers
and thanks in advance
Martin

"Situation normal - all fu***d up"
Illuminatus!

Paul Riley23-Sep-02 4:17

Paul Riley

23-Sep-02 4:17

Throwing the password backwards and forwards isn't a good idea at the best of times. Try to validate the user id using the password once and then pass the user id around in a cookie. If you must use the password, encrypt it and put that in a cookie too.

Paul

Martin Haesemeyer23-Sep-02 4:42

23-Sep-02 4:42

Thanks, I think I'll try it with two cookies...

Paul Riley wrote:
Throwing the password backwards and forwards isn't a good idea at the best of times.

Yeah, I know but the problem is that I'm calling different methods of a webservice (written by me so I could change that) from different websites - and I wanted to make sure that the user has the rights to call the specific method from within the webservice (because he could easily invoke the webservice without using my webclient, I think). Therefore the webservice needs user information passed (in a soapheader) with every call.
But maybe this approach is flawed in itself? But how can I secure a webservice from unauthorized access?

Cheers
and thanks
Martin

"Situation normal - all fu***d up"
Illuminatus!

Paul Riley23-Sep-02 4:54

Paul Riley

23-Sep-02 4:54

Hmmm... I see your point. Maybe you need to have a method in your webservice that authenticates a user/pw combo (storing details in private properties) and not allow a program or web site call any other methods until they've authenticated?

Alternatively, you might be able to use web.config authorisation but possibly not if your site is hosted.

Or I believe WebServices have been designed to allow you to sell access to the service. I don't know too much about that though. If you look into it, you might be able to use that.

Just a few ideas... if you find the answer, can you let me know? I might need this soon myself. Roll eyes | :rolleyes:

Paul

Martin Haesemeyer23-Sep-02 6:10

23-Sep-02 6:10

Paul Riley wrote:
Hmmm... I see your point. Maybe you need to have a method in your webservice that authenticates a user/pw combo (storing details in private properties) and not allow a program or web site call any other methods until they've authenticated?
That was my first thought. But the problem with this approach is: I need to create the webservice from my web application everytime a new page loads. So I would need to know the password and username at least at this point which is the same problem. If I could share the instance of the webservice across my whole web app (but AFAIK that isn't possible) I could even save the fact that the user has been authorised in the Session object of the webservice.

Paul Riley wrote:
Alternatively, you might be able to use web.config authorisation but possibly not if your site is hosted.
This wouldn't be an issue. I create the application just for fun and don't think I'll host it anywhere else than on my machine...

Paul Riley wrote:
Or I believe WebServices have been designed to allow you to sell access to the service. I don't know too much about that though. If you look into it, you might be able to use that.
I sure will - but I won't dig deeper until next week, for tomorrow is my last "Vordiplomsprüfung" and after that - well you can figure. Wink | ;)

My second thougt was just to let the application authorize itself with the webservice(with fixed "user"name and password) but that seems a little bit awkward. Well I'll wait and see...

Thank you very much for your answers
Martin

"Situation normal - all fu***d up"
Illuminatus!

Security again?

zhoujun22-Sep-02 23:34

zhoujun

22-Sep-02 23:34

If I create a permant cookie by calling
RedirectFromLoginPage("",true),
After sometime,I specify "false".
Then the users who have accessed to my website before I disable the permant cookie can still access to my web without user/pass checked?

I set up autoentication timeout=30minutes,but after that period of time,when user focus on the page again,they will be surprised that they are directed to login.aspx.
So could it be possilbe to display something that the users are timed out?

Thanks.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Martin Haesemeyer23-Sep-02 3:03

23-Sep-02 3:03

Hi!

zhoujun wrote:
Then the users who have accessed to my website before I disable the permant cookie can still access to my web without user/pass checked?
Yes I think that this is true Frown | :(

you have to sign them out first or maybe specify a different user name in you second call to RedirectFromLoginPage(..)

zhoujun wrote:
So could it be possilbe to display something that the users are timed out?
Yeah I would be interested in this one too... Confused | :confused:

Cheers
Martin

"Situation normal - all fu***d up"
Illuminatus!

zhoujun23-Sep-02 15:08

zhoujun

23-Sep-02 15:08

Thanks again,Martin.
or maybe specify a different user name in you second call to RedirectFromLoginPage(..)
How to do that?Could you say more?
Thanks.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Martin Haesemeyer24-Sep-02 2:25

24-Sep-02 2:25

zhoujun wrote:
How to do that?Could you say more?

My thought was, that maybe when u specify a different username string (can be build from the original one, a suffix should be sufficient) in your second call to FormsAuthentication.RedirectFromLoginPage this new cooki will be used for authentication, but I don't know if it would work. The best and cleanest way is maybe to first call FormsAuthentication.SignOut() to remove the persistent cookie and then log the user back in with your non-persistent cookie.

Cheers
Martin

"Situation normal - all fu***d up"
Illuminatus!

Martin Haesemeyer28-Sep-02 22:40

28-Sep-02 22:40

zhoujun wrote:
I set up autoentication timeout=30minutes,but after that period of time,when user focus on the page again,they will be surprised that they are directed to login.aspx.
So could it be possilbe to display something that the users are timed out?

I think maybe I found out (hope it works). You can do the following on your login page:

FormsIdentity ident = Context.User.Identity as FormsIdentity;
if(ident.Ticket!=null)
  if(ident.Ticket.Expired){
    //let user know that his ticket expired
  }

Cheers
HTH
Martin

"Situation normal - all fu***d up"
Illuminatus!

ASP.NET + Linux = TRUE?

Rickard Andersson²⁰22-Sep-02 22:14

22-Sep-02 22:14

Is it possible to use .NET on a Linux server with (of course) Linux OS?

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Gerald Schwab22-Sep-02 22:43

Gerald Schwab

22-Sep-02 22:43

http://www.go-mono.com[^]

Rickard Andersson²⁰22-Sep-02 23:10

22-Sep-02 23:10

Nice!
But it's not final... what I could read in the FAQ it wasn't...
But it will be!

Thank you!

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Amir Yaqoob22-Sep-02 22:54

Amir Yaqoob

22-Sep-02 22:54

well, Asp.Net web application runs only on IIS web server. I think if u can install IIS on linux server n successfully configure it then web application must run.

Paul Ingles23-Sep-02 0:42

Paul Ingles

23-Sep-02 0:42

Ages ago I got an email about testing a beta version of a package by Halcyonsoft[^], I think they were calling it iNET -- effectively converts .NET code to Java I think. Anyway, it could be worth a visit.

--
Paul
"I need the secure packaging of Jockeys. My boys need a house!"
- Kramer, in "The Chinese Woman" episode of Seinfeld

MS Messenger: paul@oobaloo.co.uk
Sonork: 100.22446

Rickard Andersson²⁰23-Sep-02 7:51

23-Sep-02 7:51

It sounds cool!
I will try it.. but... WTF.. is the beta an evalution version?? WTF | :WTF:

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Paul Ingles24-Sep-02 5:47

Paul Ingles

24-Sep-02 5:47

You'll probably find its unsupported to some extent. If you actively use it and report problems with the software then you'll be given support, but since its not complete you can't expect it to work flawlessly.

As for evaluation, check in any terms and conditions before you download. You may find that you can only use it until a certain date (by which point a final edition may be available).

--
Paul
"I need the secure packaging of Jockeys. My boys need a house!"
- Kramer, in "The Chinese Woman" episode of Seinfeld

MS Messenger: paul@oobaloo.co.uk
Sonork: 100.22446

Rickard Andersson²⁰23-Sep-02 8:00