Web Development

Re: Transferring info between to pages - secure?

23-Sep-02 4:42

Thanks, I think I'll try it with two cookies...

Paul Riley wrote:
Throwing the password backwards and forwards isn't a good idea at the best of times.

Yeah, I know but the problem is that I'm calling different methods of a webservice (written by me so I could change that) from different websites - and I wanted to make sure that the user has the rights to call the specific method from within the webservice (because he could easily invoke the webservice without using my webclient, I think). Therefore the webservice needs user information passed (in a soapheader) with every call.
But maybe this approach is flawed in itself? But how can I secure a webservice from unauthorized access?

Cheers
and thanks
Martin

"Situation normal - all fu***d up"
Illuminatus!

Paul Riley23-Sep-02 4:54

Paul Riley

23-Sep-02 4:54

Hmmm... I see your point. Maybe you need to have a method in your webservice that authenticates a user/pw combo (storing details in private properties) and not allow a program or web site call any other methods until they've authenticated?

Alternatively, you might be able to use web.config authorisation but possibly not if your site is hosted.

Or I believe WebServices have been designed to allow you to sell access to the service. I don't know too much about that though. If you look into it, you might be able to use that.

Just a few ideas... if you find the answer, can you let me know? I might need this soon myself. Roll eyes | :rolleyes:

Paul

Re: Transferring info between to pages - secure?

Martin Haesemeyer23-Sep-02 6:10

23-Sep-02 6:10

Paul Riley wrote:
Hmmm... I see your point. Maybe you need to have a method in your webservice that authenticates a user/pw combo (storing details in private properties) and not allow a program or web site call any other methods until they've authenticated?
That was my first thought. But the problem with this approach is: I need to create the webservice from my web application everytime a new page loads. So I would need to know the password and username at least at this point which is the same problem. If I could share the instance of the webservice across my whole web app (but AFAIK that isn't possible) I could even save the fact that the user has been authorised in the Session object of the webservice.

Paul Riley wrote:
Alternatively, you might be able to use web.config authorisation but possibly not if your site is hosted.
This wouldn't be an issue. I create the application just for fun and don't think I'll host it anywhere else than on my machine...

Paul Riley wrote:
Or I believe WebServices have been designed to allow you to sell access to the service. I don't know too much about that though. If you look into it, you might be able to use that.
I sure will - but I won't dig deeper until next week, for tomorrow is my last "Vordiplomsprüfung" and after that - well you can figure. Wink | ;)

My second thougt was just to let the application authorize itself with the webservice(with fixed "user"name and password) but that seems a little bit awkward. Well I'll wait and see...

Thank you very much for your answers
Martin

"Situation normal - all fu***d up"
Illuminatus!

Security again?

zhoujun22-Sep-02 23:34

zhoujun

22-Sep-02 23:34

If I create a permant cookie by calling
RedirectFromLoginPage("",true),
After sometime,I specify "false".
Then the users who have accessed to my website before I disable the permant cookie can still access to my web without user/pass checked?

I set up autoentication timeout=30minutes,but after that period of time,when user focus on the page again,they will be surprised that they are directed to login.aspx.
So could it be possilbe to display something that the users are timed out?

Thanks.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Martin Haesemeyer23-Sep-02 3:03

23-Sep-02 3:03

Hi!

zhoujun wrote:
Then the users who have accessed to my website before I disable the permant cookie can still access to my web without user/pass checked?
Yes I think that this is true Frown | :(

you have to sign them out first or maybe specify a different user name in you second call to RedirectFromLoginPage(..)

zhoujun wrote:
So could it be possilbe to display something that the users are timed out?
Yeah I would be interested in this one too... Confused | :confused:

Cheers
Martin

"Situation normal - all fu***d up"
Illuminatus!

zhoujun23-Sep-02 15:08

zhoujun

23-Sep-02 15:08

Thanks again,Martin.
or maybe specify a different user name in you second call to RedirectFromLoginPage(..)
How to do that?Could you say more?
Thanks.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Martin Haesemeyer24-Sep-02 2:25

24-Sep-02 2:25

zhoujun wrote:
How to do that?Could you say more?

My thought was, that maybe when u specify a different username string (can be build from the original one, a suffix should be sufficient) in your second call to FormsAuthentication.RedirectFromLoginPage this new cooki will be used for authentication, but I don't know if it would work. The best and cleanest way is maybe to first call FormsAuthentication.SignOut() to remove the persistent cookie and then log the user back in with your non-persistent cookie.

Cheers
Martin

"Situation normal - all fu***d up"
Illuminatus!

Martin Haesemeyer28-Sep-02 22:40

28-Sep-02 22:40

zhoujun wrote:
I set up autoentication timeout=30minutes,but after that period of time,when user focus on the page again,they will be surprised that they are directed to login.aspx.
So could it be possilbe to display something that the users are timed out?

I think maybe I found out (hope it works). You can do the following on your login page:

FormsIdentity ident = Context.User.Identity as FormsIdentity;
if(ident.Ticket!=null)
  if(ident.Ticket.Expired){
    //let user know that his ticket expired
  }

Cheers
HTH
Martin

"Situation normal - all fu***d up"
Illuminatus!

ASP.NET + Linux = TRUE?

Rickard Andersson²⁰22-Sep-02 22:14

22-Sep-02 22:14

Is it possible to use .NET on a Linux server with (of course) Linux OS?

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Gerald Schwab22-Sep-02 22:43

Gerald Schwab

22-Sep-02 22:43

http://www.go-mono.com[^]

Rickard Andersson²⁰22-Sep-02 23:10

22-Sep-02 23:10

Nice!
But it's not final... what I could read in the FAQ it wasn't...
But it will be!

Thank you!

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Amir Yaqoob22-Sep-02 22:54

Amir Yaqoob

22-Sep-02 22:54

well, Asp.Net web application runs only on IIS web server. I think if u can install IIS on linux server n successfully configure it then web application must run.

Paul Ingles23-Sep-02 0:42

Paul Ingles

23-Sep-02 0:42

Ages ago I got an email about testing a beta version of a package by Halcyonsoft[^], I think they were calling it iNET -- effectively converts .NET code to Java I think. Anyway, it could be worth a visit.

--
Paul
"I need the secure packaging of Jockeys. My boys need a house!"
- Kramer, in "The Chinese Woman" episode of Seinfeld

MS Messenger: paul@oobaloo.co.uk
Sonork: 100.22446

Rickard Andersson²⁰23-Sep-02 7:51

23-Sep-02 7:51

It sounds cool!
I will try it.. but... WTF.. is the beta an evalution version?? WTF | :WTF:

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Paul Ingles24-Sep-02 5:47

Paul Ingles

24-Sep-02 5:47

You'll probably find its unsupported to some extent. If you actively use it and report problems with the software then you'll be given support, but since its not complete you can't expect it to work flawlessly.

As for evaluation, check in any terms and conditions before you download. You may find that you can only use it until a certain date (by which point a final edition may be available).

--
Paul
"I need the secure packaging of Jockeys. My boys need a house!"
- Kramer, in "The Chinese Woman" episode of Seinfeld

MS Messenger: paul@oobaloo.co.uk
Sonork: 100.22446

Rickard Andersson²⁰23-Sep-02 8:00

Cannot send email with CDO NTS

23-Sep-02 8:00

One question:
What download am I suppose to take?
The bundled or unbundled?

If the Linux OS don't have the JDK or something, should I take the bundled then?

Rickard Andersson@Suza Computing
C# and C++ programmer from SWEDEN!
UIN: 50302279
E-Mail: nikado@pc.nu
Speciality: I love C#, ASP.NET and C++!

Anonymous22-Sep-02 12:32

Anonymous

22-Sep-02 12:32

Hi Pals
This might be a simple one for most of you!
I am trying to send an email using CDO NTS, with the following code

Set objMail = Server.CreateObject("CDONTS.NewMail")
objMail.To = "myname@yahoo.com"
objMail.Body = "Test Email"
objMail.From = "myname@yahoo.com"
objMail.Subject="Test Email"
objMail.BodyFormat=0
objMail.Send
Set objMail = nothing

the mail is not sent when i ran the above code, i checked for SMTP services on my machine, which is a WIN 2K server in my office network, they are running too.
what might be the problem?

I ran the same code from my home machine which is again win2k server and it worked perfectly...
any suggestions as why its not working???

Thanks for your help in advance
Jon.

MHeckman22-Sep-02 12:51

22-Sep-02 12:51

How do you have relaying configured?

Anonymous22-Sep-02 13:01

Anonymous

22-Sep-02 13:01

I am not sure what exactly relaying means?
didnt do any configuration from my end, thought everything was set default, and we can use it straight forward.
ALl i did was checked in the Services for SMTP, and it is running, is there something i am missing here!!
Thanks

MHeckman22-Sep-02 13:13

22-Sep-02 13:13

Relaying is the action of transmitting a mail via SMTP services. Most SMTP services recommend that you turn it off or authenticate using one way or another. It all ties back to an individual being able to use your server to "relay" their spam...

Is there anyone else using this SMTP server? I have a few questions reqarding the configuration...

MHeckman22-Sep-02 13:23

ASP.NET - mixing controls

22-Sep-02 13:23

Here's an article that might help...

http://www.microsoft.com/windows2000/en/advanced/help/default.asp?url=/windows2000/en/advanced/help/moc04_57.htm

Christian Graus22-Sep-02 12:19

Christian Graus

22-Sep-02 12:19

I started ASP.NET last night, and I put an ASP:Label in my page, and some normal text. The text is rendered so that it's written over the label. How do I mix asp controls and html so that each lines up with the other, or can't I ?

Christian

Hey, at least Logo had, at it's inception, a mechanical turtle. VB has always lacked even that... - Shog9 04-09-2002

During last 10 years, with invention of VB and similar programming environments, every ill-educated moron became able to develop software. - Alex E. - 12-Sept-2002

Re: ASP.NET - mixing controls

MHeckman22-Sep-02 12:56

Re: ASP.NET - mixing controls

22-Sep-02 12:56

First question: Do you have it configured for Grid or Flow layout?

My first assumption is that the label control could be using placement coordinates whereas your normal text is not, therefore allowing for "overlapping".

Christian Graus22-Sep-02 13:04

Christian Graus

22-Sep-02 13:04

I thought of that this morning - it's grid I believe ( the default ). Will changing it fix my problem ?

It's also all in a server run form if that makes any difference.

Christian

Hey, at least Logo had, at it's inception, a mechanical turtle. VB has always lacked even that... - Shog9 04-09-2002

During last 10 years, with invention of VB and similar programming environments, every ill-educated moron became able to develop software. - Alex E. - 12-Sept-2002

Re: ASP.NET - mixing controls

MHeckman22-Sep-02 13:16