|
Hi Folks:
We have applications that use a lot of our own webservices .Now we want some of the functionality in our webservices to be hidden from view even if theperson manages to break into the asmx page that lists out all webservices being offered.
Where exactly in the function defnition do i specify that the function is not to be listed out in the asmx page..
Thanks in advance for your help..
Regards
Pradhip.S
Why Need Parking lots in Bars when Drunken Driving is Prohibited
|
|
|
|
|
Why don't you just enable some security on the services you wish to "hide?" That way, if they do see it, they still may not be able to call it unless they crack your security as well.
"The greatest danger to humanity is humanity without an open mind."
- Ian Mariano
http://www.ian-space.com/
|
|
|
|
|
Hi,
I think with the release of Microsoft Web Services Development Kit (WSDK) Technology Preview, there are also some authentication mechanisms that are available along with the message itself.
Perhaps you can try that and see if that should be useful for your objective.
Deepak Kumar Vasudevan
http://deepak.portland.co.uk/
|
|
|
|
|
here's a small dillema i have.. done for the sole purpose of security.. i have a modified version of a program called 'browseamp' which installs a mini web browser onto winamp. i also have iis running on that web server (standard port.. port 80).. i have browseamp running on port 81 but i have bound it to LOCALHOST only, which means it will accept calls ONLY from that local machine (so say, no one tries to flood port 81 and crashing winamp) .. i run a huge internet radio station and the goal is to get the dj's to start their own shows by using this browseamp plugin.. i already have the 'commands' to pass to the browseamp plugin, buti want, perhaps through asp, IIS to pass those to localhost:81 etc etc...
how can i do this.. is this some kind of redirect fuction? .. remember this will be a client from the outside, accessing the iis server (Which does accept the outside connections) and then the IIS server calling the browseamp server on localhost:81 ...
i'm confused, perplexed, and just dumbfounded by how i could do this.
any help would be appreciated.
thanks!
michelle
bassdrive.com
|
|
|
|
|
How about using xmlhttp (or asptear) to request the page from localhost?
|
|
|
|
|
Hi all
Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security. 
CHeers
"There are no stupid question's, just stupid people."
|
|
|
|
|
I would never leave any personally identifiable information in a cookie, such as a username, email, name, address, et al.
Probably the best place to start is the Platform for Privacy Preferences (P3P) Project[^].
Interesting: Microsoft Privacy and Security Fundamentals[^]. Quite useful and informative to see what your browser tells the "world," as well as a good starting point for you.
There are a ton of sites about cookies, but they are only a small part of the whole Privacy and Security issue.
-- ian
"The greatest danger to humanity is humanity without an open mind."
- Ian Mariano
http://www.ian-space.com/
|
|
|
|
|
leppie wrote:
Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security
I do not know the details but there are ways and means of hijacking cookies, so don't store sensitive information in them.
Paul Watson
Bluegrass
Cape Town, South Africa
Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson
|
|
|
|
|
A cookie cannot be accessed by another site (because the client machine sends them based on url), but they can be created by another site for your use. In that way they're totally secure.
But they are sent as part of every HTTP request to the site that they're designated to, so it's possible for them to be "caught" if you're not in an SSL area of the site.
An unencrypted username and email isn't going to be much use to anyone, hence nearly every site has a "keep me logged on" checkbox that allows you to accept your own user id as a cookie.
But I wouldn't advise using cookies to send unencrypted passwords or even encrypted credit card information around.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
Paul Riley wrote:
A cookie cannot be accessed by another site (because the client machine sends them based on url)
That isn't entirely true.
It's true in the respect that it is how it is supposed to work, but security flaws keep on popping up in browsers that allow for a malicious website to access a user's cookies for a different site
--
Help me! I'm turning into a grapefruit!
|
|
|
|
|
That's a fair comment. It's only as secure as any other information on your harddrive, possibly less so because the browser must be able to access it or cookies won't work.
However, the fact still remains that it's almost secure and information like user id and email address aren't generally the kind of thing people who write such malicious sites are looking for.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
OK thanx all
I have a single value in my cookie at the moment (ASP.NET Authetication cookie) that is encypted, so I should not have to worry about that. I was wondering about email addys specifically, but I guess I can pull that from SQL
Cheers
"There are no stupid question's, just stupid people."
|
|
|
|
|
leppie wrote:
I was wondering about email addys specifically, but I guess I can pull that from SQL
If you have the information already on the server then use it. Cookies are more for state management (identifying the user) than for storing information about the user, especially information you already have.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
Thanx 
"There are no stupid question's, just stupid people."
|
|
|
|
|
So does that mean we can look forward to an article on cookie encryption? 
I've always heard that there was an idea behind Win ME... I still can't figure out what that was... anyboy know??? I;ve herad the idea was that it was supposed to be n operating system but I doubt this. - Brian Delahunty
|
|
|
|
|
Megan Forbes wrote:
So does that mean we can look forward to an article on cookie encryption?
No, ASP.NET does everything automatically  , if you dont need roles.
"There are no stupid question's, just stupid people."
|
|
|
|
|
 We only get to upgrade to .Net in January. I feel so deprived... 
I've always heard that there was an idea behind Win ME... I still can't figure out what that was... anyboy know??? I;ve herad the idea was that it was supposed to be n operating system but I doubt this. - Brian Delahunty
|
|
|
|
|
I reckon I know enough of ASP.NET after 1 month crash-coursing it But having done C# the last 6-7 months has been a real help
"There are no stupid question's, just stupid people."
|
|
|
|
|
I have this code that i use to query my database to pull out customers email addresses, however i am trying to get it to pull out email accounts from a whole list of domain names ( i.e from a comma seperated values e.g domain1.com, domain2.com )
So that i can do a bulk search and get bulk results as
domain1.com fred@somehotmail.com
domain1.com fredrika@someotherhotmail.com
---------------------------here is the current code--------------------------
<%
var-domain = Request.Querystring("domain-name")
SQL="SELECT email FROM requests WHERE domain = '" & var-domain & "'"
Set connb = server.createobject("ADODB.Connection")
connb.open "some-connection"
set user = connb.execute(SQL)
Do UNTIL user.EOF
var-email=user.Fields("email")
%>
<p><b><%-var-domain %> sdasda</b></p>
<% user.MoveNext
Loop
connb.close %>
-----------------------------------------------------------------------------------
|
|
|
|
|
This should work:
<code>
dim domain, sql, conn, adors
domain = trim(replace(Request.QueryString("domain"), "'", "''"))
sql = "SELECT email FROM requests WHERE domain = '" & domain & "'"
conn = Server.CreateObject("ADODB.Connection")
adors = Server.CreateObject("ADODB.Recordset")
conn.ConnectionString = "[YourConnectionString]"
conn.Open
adors.ActiveConnection = conn
adors.Open(sql)
With Response
Do Until adors.EOF
.Write "E-Mail:" & adors("email") & " " & domain & "<br>"
.Write adors.MoveNext
Loop
End With
adors.Close
Set adors = Nothing
conn.Close
Set conn = Nothing
</code>
Nick Parker
May your glass be ever full.
May the roof over your head be always strong.
And may you be in heaven half an hour before the devil knows you’re dead. - Irish Blessing
|
|
|
|
|
Are there any standards about say when an asp page containing form submitted and I want to retrive form field values from the submitted action?
I see request.form("some form field name") ,and request.querystring("some form field name"),and even request("some form field name");Any differences?
I am not a much skilled asp programmer.So anyone please say some to me.
Thanks.
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
|
Here you go.
If you are parsing query string, just replace request.form with request.querystring.
sub EnumForm()
dim theKey
for each theKey in Request.Form
response.write theKey & " -- " & Request.Form(theKey) & "<BR>"
next
end sub
|
|
|
|
|
Thanks.
So what is the difference between "query sting" and "form field string"?
And what is the meaning of "request("some form field name")"?
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
|
If your form has method="get", or no method defined, the values will be passed in the query-string - e.g. http://www.yourdomain.com/page.asp?Field1=Value&Field2=Another%20Value. To access them, you need to use Request.QueryString. The amount of data you can accept is extremely limited, and will be visible in the browser history, so this method is not recommended for long forms.
If you have a form with method="post", the form values will be passed in the body of the request, and you will access them using Request.Form.
Code which calls Request("some form field name") allows for values to be passed in through either method. However, this will check all server collections (ServerVariables, Cookies, etc.) which is much less efficient than checking the correct collection.
|
|
|
|
|
Thanks,Richard.
The info is much understandable.
But I still has some puzzles.
you said "If your form has method="get", or no method defined".
What about no form defined?Can I use the http example you gave and retrieve field1 and field2 values using request.querysting("field")?
And you said "The amount of data you can accept is extremely limited",what is the limitation?
Thanks again.
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
