|
I've been doing alot of web dev lately and just realized a potential treat to using cookies as an authentication mechanism.
1) How are cookie data encrypted? I looked at one and noticed it must be, but who is responsible for it? Codeproject for instance has encrypted cookie data, but is it JScript/VBScript or PHP/Perl responsibility using private key? Is this done by the browser?
2) Assuming I had a temp account somewhere to try their website out  but the pass only lasted 3 days. Whats to stop me from just resetting my system clock to an earlier date how then would the cookie know when to delete it self? I could then have unlimited access to the site???
Anyways just some ideas i'm passing around in my head, perhaps you can shed some light on this subject for me?
Thanks
p.s-This is probably why places like paypal support only session cookies? Or so it appears.
"Two wrongs don't make a right, but three lefts do!" - Alex Barylski
|
|
|
|
|
Hockey wrote:
1) How are cookie data encrypted? I looked at one and noticed it must be, but who is responsible for it? Codeproject for instance has encrypted cookie data, but is it JScript/VBScript or PHP/Perl responsibility using private key? Is this done by the browser?
As far as I understand it, authentication cookies are encrypted by the server, the client never sees the unencrypted ticket. Why would it need to?
As for how it's encrypted, this also is the responsibility of the server-side developer. If you, as that developer, use a huge encryption key that nobody else knows then there is really no security threat here.
Hockey wrote:
2) Assuming I had a temp account somewhere to try their website out but the pass only lasted 3 days. Whats to stop me from just resetting my system clock to an earlier date how then would the cookie know when to delete it self? I could then have unlimited access to the site???
This is true. But is anyone really going to do that? It would make your computer largely unusable.
Paul
Pleasently caving in, I come undone - Queens of the Stone Age, No One Knows
|
|
|
|
|
As far as I understand it, authentication cookies are encrypted by the server, the client never sees the unencrypted ticket. Why would it need to?
I've had to need to share information with both client/server before and cookies made this possible, but I guess for a login script it's not totally nessecary. I was hoping to be able to have some JScript check the existance of a authenticated cookie name/value and offer some pre warning via message boxes that YOU MUST LOGIN BEFORE ACCESSING THIS PAGE, but I guess i'll have to do it on the server side of things.
Paul Riley wrote:
This is true. But is anyone really going to do that? It would make your computer largely unusable.
I've used that technnique on shareware before...but your right it becomes to much of a pain to last forever.
Thanks for you input...
Cheers!
"Two wrongs don't make a right, but three lefts do!" - Alex Barylski
|
|
|
|
|
Hockey wrote:
I've had to need to share information with both client/server before and cookies made this possible, but I guess for a login script it's not totally nessecary.
Exactly! In fact, once the user id / password has been received and verified by the server, the only thing you need in the cookie is the user id, encrypted or not.
Hockey wrote:
I was hoping to be able to have some JScript check the existance of a authenticated cookie name/value and offer some pre warning via message boxes that YOU MUST LOGIN BEFORE ACCESSING THIS PAGE, but I guess i'll have to do it on the server side of things
Yeah. For securities sake, it's always better to verify everything on the server side. You can have validation on the client side AS WELL, for the convenience of the user and to save unnecessary requests to the server, but there are too many ways to bypass client-side validation using malicious programs so you should check it again.
That goes for absolutely any information being passed to the server.
Hockey wrote:
I've used that technnique on shareware before...but your right it becomes to much of a pain to last forever.
Also, you'll almost certainly find that most web pages that have limited membership will validate the user id on the server against a database which holds the start or end date of membership.
Few will rely on the cookie expiry date to end membership, in fact many will want to hold onto the cookie to make sure that no one signs up for an extra "trial" period some months later.
Paul
Pleasently caving in, I come undone - Queens of the Stone Age, No One Knows
|
|
|
|
|
Hockey wrote:
Assuming I had a temp account somewhere to try their website out but the pass only lasted 3 days. Whats to stop me from just resetting my system clock to an earlier date how then would the cookie know when to delete it self? I could then have unlimited access to the site???
Why it have to delete a cookie? In this scenario you (as a developer) will have to encrypt a starting date into cookie as well, so you can always check it later
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
|
|
|
|
|
Philip Patrick wrote:
Why it have to delete a cookie? In this scenario you (as a developer) will have to encrypt a starting date into cookie as well, so you can always check it later
That was one solution I considered. Now I just have to find a free private key encryption algorithm.
"Two wrongs don't make a right, but three lefts do!" - Alex Barylski
|
|
|
|
|
I am needing a unique solution. I have found answers here in the past for development, but I honestly don't know where to start with this one, so I'll start here.
What I am wanting to do is in theory: I am doing R & D for a program which will allow for a client to do an employee report via a web driven application. During this report, the customer is wanting to take a picture of the employee and attach it to the report. In order to do this, they will have to be able to take the picture with a high quality digital camera and dynamically attach it to the report. I need thoughts on how to do this all through a web browser without any software loaded on the local machine.
Thanks,
Robby
|
|
|
|
|
Uploading files to a server through a browser is pretty easy and the solution can be found without much trouble. If you expect to be able to get an image from a camera through a browser then your dreaming.
Jason Henderson
start page ; articles
henderson is coming
henderson is an opponent's worst nightmare
* googlism *
|
|
|
|
|
Jason, actually we have been successful in transfering an image via a web browser from a camera with minimal trouble for the end-user. It appears from your response that you totally misunderstood my question.
|
|
|
|
|
How did you do it without installing anything on the client machine? DCOM?
Jason Henderson
start page ; articles
henderson is coming
henderson is an opponent's worst nightmare
* googlism *
|
|
|
|
|
Anyone have some info about this?
I have moved this small SSL site to outher machine (only this site on this new Server), the accessed pages are allways the same and the errors are random (now you see it , now you dont)
I have review all the code, (VC COM Objects,VB COM objects, ASP code and VC ISAPIS) and found nothing.
Please Help me 
_______________________________
Portal Imoguia Software Imoguia
MSN:maxsnts@hotmail.com
|
|
|
|
|
Hi ...
How can I show a pictur with asp directly.
& don't using HTML .
it mean what Pic address be for exampl showimage.asp
there is an Exampl http://www.sorna.net/webmail/showimage.asp
I'm Sorry For my English 
Iman Ghasrfakhri
|
|
|
|
|
Load an image into ADODB.Stream and write it out using Response object. Remember to add appropriate headers (content type) also and NO html should be written out.
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
|
|
|
|
|
tnX for your help
but may you tell me about appropriate headers more?
Iman Ghasrfakhri
|
|
|
|
|
I'm doing like this: (I did the same task also)
Response.ContentType = ImageType
Response.AddHeader "Content-Type", ImageType
Response.AddHeader "Content-Disposition", "inline; filename=" & "filename.jpg"
Where ImageType can be for example "image/gif" or "image/pjpeg"
Content-Disposition set to inline just to let the browser to render the image instead of making it for download. Don't quite remember why I set the header Content-Type twice, but maybe there was a reason
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
|
|
|
|
|
It seems I must host a bunch of files on a secure socket server, instead of the current "plain http" server. Can anyone provide me with a rule of thumb how that change will impact the performance in accessing those files?
Any ballpark figures by how much the preformance will drop?
Also, will browsers like IE and Mozilla still locally cache data coming from a secure socket server?
TIA
Bernd
|
|
|
|
|
ummmm the encrypting / decrypting takes a significant time slice if u have heavy loads running over ssl
ballpark figures? maybe 40% worse performance?
"traffic lights are for people who can't make their own decisions"
biz stuff about me
|
|
|
|
|
From a browser I can goto the root folder of my personal web pages and can see a directory listing of the files and directories. How can I stop visitors from seeing the same and instead see a Index.htm, i.e. by default a certain html file is returned to their browser?
Andy
|
|
|
|
|
If you have full control over the server, you can go into IIS, right-click the site, select Properties.
Then in the Documents tab, there is a list of files that the server will search for before showing a directory listing (assuming the "Enable Default Document" check box is set).
You can also stop directory browsing here under the Home Directory tab, just uncheck the box marked "Directory Browsing".
If your site is hosted then you need to talk to the hosting company.
Paul
Pleasently caving in, I come undone - Queens of the Stone Age, No One Knows
|
|
|
|
|
try using a .htaccess file I think the syntax is
Options +Indexes
Alternatively justs use the index file name as specified by your hosting company, probably index.htm or index.html, if you are hosting a a UNI* server the name is case sensitive.
|
|
|
|
|
I'm trying to call a C++ app that I wrote from my website via javascript but am having a lot of problems. Being new to the whole web development world, I'm unsure as to how to actually do this and make it work. What I'm trying to do is retrieve information entered in a form on a page. I want to save the information but don't have a database set up to save it to and I don't want it to open up a mail window where the user has to send the data. I want to collect it transparently to the user. I'm wrote a simple C++ app that writes the data to a file, but can't get it to work from the javascript. Can someone tell me how to do that or, even better, a better way to get the information in my hands without the user having to do anything other than enter their information in the form and click submit?
|
|
|
|
|
Sure, using CDO if you are in Windows environment, or sendmail if you are in Unix. Both should be done in server-side script, just collect all input and send to you by e-mail.
As an alternative way you can just store all input in files (again using a server-side script)
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
|
|
|
|
|
Yeah, that's what I'm trying to do. I wrote a basic C++ app to write the information I want to a file on the server. I'm trying to call that executable from the client-side javascript on the HTML page. I'm apparently doing something wrong because it throws an error talking about unexpected end of script headers or something like that. I've changed the app to be nothing more than just a main function that doesn't do anything. I still can't get it to work. I must be calling it wrong from the javascript or something.
here's the code:
var commandLine;
commandLine = "param1=" + name + '&' + "param2=" + school + '&' + "param3=" + email + '&' + "param4=" + city + '&' + "param5=" + state + '&' + "param6=" + "Y"
window.document.location = "http://www.agdsoftware.com/cgi-bin/EvaluationCgi.exe?" + commandLine;
Any thoughts?
|
|
|
|
|
Your executable is ISAPI Extention/Filter, right?
Philip Patrick
Web-site: www.stpworks.com
"Two beer or not two beer?" Shakesbeer
|
|
|
|
|
No, it's just an executable. I don't know if this is the proper way to do this as I've never done any web development. I thought I could write an app and call it from the webpage to have it run on the server, take the information I send it, and create a file with that information in it. Can I not do that?
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
