Search Results

Search found 13776 results on 552 pages for 'password reset'.

Page 326/552 | < Previous Page | 322 323 324 325 326 327 328 329 330 331 332 333  | Next Page >

  • IE sends multiple cookies with same name?

    - by akach
    I have a strange bug that occurs in IE7/XP and IE8/Vista on my website. IE sends two cookies named PHPSESSID. How to reproduce: Clear cookies in IE (not necessary if you never visited unisender.com). Visit unisender.com (exactly without www to reproduce!) and it will redirect to www.unisender.com Login with any valid username and password (I've registered username testmsdn with password testmsdn - feel free to use for testing) Run your favourite capture-the-traffic program (I prefer wireshark) Now click any menu link (e.g. "messages") Look at captured traffic - you will see that IE sends double PHPSESSID cookie (and you are logged out after click because of this). It seems like first PHPSESSID is from unisender.com and second from www.unisender.com. Captured sample: GET /en/letter_list HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, / Referer: http://www.unisender.com/en/intro Accept-Language: ru User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.21022; .NET CLR 3.5.30729; FDM; .NET CLR 3.0.30729) Accept-Encoding: gzip, deflate Host: www.unisender.com Connection: Keep-Alive Cookie: authchallenge=3a9cfcfc9fe33822e3e21d75c8a3d3e4; PHPSESSID=14ea1cb133632951592397c86eaf037e; us_reg_ref=unknown; us_reg_url=http%3A%2F%2Funisender.com%2F; __utma=1.778517853.1271204400.1271204400.1271204400.1; __utmb=1.3.10.1271204400; __utmc=1; __utmz=1.1271204400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=65e110aeb995a66b9dc8da5656c7a3da; last_login_name=testmsdn I've tried to use session and non-session cookies, tried to use .unisender.com instead of unisender.com for cookie - nothing helps. I suppose there should not be cookies with same name. Am I right? Is it a bug in IE? If it's a bug then is there a workaround? Or am I wrong and it's an expected behavior?

    Read the article

  • SINGLE SIGN ON SECURITY THREAT! FACEBOOK access_token broadcast in the open/clear

    - by MOKANA
    Subsequent to my posting there was a remark made that this was not really a question but I thought I did indeed postulate one. So that there is no ambiquity here is the question with a lead in: Since there is no data sent from Facebook during the Canvas Load process that is not at some point divulged, including the access_token, session and other data that could uniquely identify a user, does any one see any other way other than adding one more layer, i.e., a password, sent over the wire via HTTPS along with the access_toekn, that will insure unique untampered with security by the user? Using Wireshark I captured the local broadcast while loading my Canvas Application page. I was hugely surprised to see the access_token broadcast in the open, viewable for any one to see. This access_token is appended to any https call to the Facebook OpenGraph API. Using facebook as a single click log on has now raised huge concerns for me. It is stored in a session object in memory and the cookie is cleared upon app termination and after reviewing the FB.Init calls I saw a lot of HTTPS calls so I assumed the access_token was always encrypted. But last night I saw in the status bar a call from what was simply an http call that included the App ID so I felt I should sniff the Application Canvas load sequence. Today I did sniff the broadcast and in the attached image you can see that there are http calls with the access_token being broadcast in the open and clear for anyone to gain access to. Am I missing something, is what I am seeing and my interpretation really correct. If any one can sniff and get the access_token they can theorically make calls to the Graph API via https, even though the call back would still need to be the site established in Facebook's application set up. But what is truly a security threat is anyone using the access_token for access to their own site. I do not see the value of a single sign on via Facebook if the only thing that was established as secure was the access_token - becuase for what I can see it clearly is not secure. Access tokens that never have an expire date do not change. Access_tokens are different for every user, to access to another site could be held tight to just a single user, but compromising even a single user's data is unacceptable. http://www.creatingstory.com/images/InTheOpen.png Went back and did more research on this: FINDINGS: Went back an re ran the canvas application to verify that it was not any of my code that was not broadcasting. In this call: HTTP GET /connect.php/en_US/js/CacheData HTTP/1.1 The USER ID is clearly visible in the cookie. So USER_ID's are fully visible, but they are already. Anyone can go to pretty much any ones page and hover over the image and see the USER ID. So no big threat. APP_ID are also easily obtainable - but . . . http://www.creatingstory.com/images/InTheOpen2.png The above file clearly shows the FULL ACCESS TOKEN clearly in the OPEN via a Facebook initiated call. Am I wrong. TELL ME I AM WRONG because I want to be wrong about this. I have since reset my app secret so I am showing the real sniff of the Canvas Page being loaded. Additional data 02/20/2011: @ifaour - I appreciate the time you took to compile your response. I am pretty familiar with the OAuth process and have a pretty solid understanding of the signed_request unpacking and utilization of the access_token. I perform a substantial amount of my processing on the server and my Facebook server side flows are all complete and function without any flaw that I know of. The application secret is secure and never passed to the front end application and is also changed regularly. I am being as fanatical about security as I can be, knowing there is so much I don’t know that could come back and bite me. Two huge access_token issues: The issues concern the possible utilization of the access_token from the USER AGENT (browser). During the FB.INIT() process of the Facebook JavaScript SDK, a cookie is created as well as an object in memory called a session object. This object, along with the cookie contain the access_token, session, a secret, and uid and status of the connection. The session object is structured such that is supports both the new OAuth and the legacy flows. With OAuth, the access_token and status are pretty much al that is used in the session object. The first issue is that the access_token is used to make HTTPS calls to the GRAPH API. If you had the access_token, you could do this from any browser: https://graph.facebook.com/220439?access_token=... and it will return a ton of information about the user. So any one with the access token can gain access to a Facebook account. You can also make additional calls to any info the user has granted access to the application tied to the access_token. At first I thought that a call into the GRAPH had to have a Callback to the URL established in the App Setup, but I tested it as mentioned below and it will return info back right into the browser. Adding that callback feature would be a good idea I think, tightens things up a bit. The second issue is utilization of some unique private secured data that identifies the user to the third party data base, i.e., like in my case, I would use a single sign on to populate user information into my database using this unique secured data item (i.e., access_token which contains the APP ID, the USER ID, and a hashed with secret sequence). None of this is a problem on the server side. You get a signed_request, you unpack it with secret, make HTTPS calls, get HTTPS responses back. When a user has information entered via the USER AGENT(browser) that must be stored via a POST, this unique secured data element would be sent via HTTPS such that they are validated prior to data base insertion. However, If there is NO secured piece of unique data that is supplied via the single sign on process, then there is no way to guarantee unauthorized access. The access_token is the one piece of data that is utilized by Facebook to make the HTTPS calls into the GRAPH API. it is considered unique in regards to BOTH the USER and the APPLICATION and is initially secure via the signed_request packaging. If however, it is subsequently transmitted in the clear and if I can sniff the wire and obtain the access_token, then I can pretend to be the application and gain the information they have authorized the application to see. I tried the above example from a Safari and IE browser and it returned all of my information to me in the browser. In conclusion, the access_token is part of the signed_request and that is how the application initially obtains it. After OAuth authentication and authorization, i.e., the USER has logged into Facebook and then runs your app, the access_token is stored as mentioned above and I have sniffed it such that I see it stored in a Cookie that is transmitted over the wire, resulting in there being NO UNIQUE SECURED IDENTIFIABLE piece of information that can be used to support interaction with the database, or in other words, unless there were one more piece of secure data sent along with the access_token to my database, i.e., a password, I would not be able to discern if it is a legitimate call. Luckily I utilized secure AJAX via POST and the call has to come from the same domain, but I am sure there is a way to hijack that. I am totally open to any ideas on this topic on how to uniquely identify my USERS other than adding another layer (password) via this single sign on process or if someone would just share with me that I read and analyzed my data incorrectly and that the access_token is always secure over the wire. Mahalo nui loa in advance.

    Read the article

  • Windows/Samba connection error

    - by Gomibushi
    I have a Linux fileserver serving up /home for linux and windows users. I was able to connect from my windows client, but not from a DC. Then suddenly I could connect from the DC too. The linux servers run Centrify clients, and as such are part of the domain. All on same subnet. This is what the the log.smbd says, repeatedly: [2010/02/11 11:25:57, 0] lib/util_sock.c:read_data(534) read_data: read failure for 4 bytes to client 192.168.200.3. Error = Connection reset by peer On Windows it appeared as an "unknown error". EDIT: the error code is "0x80004005". We are developing a system depended on the samba share, and are worried this will appear again. It would be nice to pin point the root of this. Any ideas what this might be? Places to look?

    Read the article

  • Cannot run gnome-session

    - by Brian
    I'm having issues running an X Windows session on a RHEL5 64-bit server - whenever I execute the command "gnome-session &", the process goes into the background but nothing happens. I have Exceed installed on my Windows machine which is running when I try to start the gnome-session. I've tried just starting firefox by itself instead of the whole gnome session, but it doesn't work either. Any suggestions? BTW, here's the error message I get when I try to start firefox: firefox: Fatal IO error 104 (Connection reset by peer) on X server localhost:10.0.

    Read the article

  • Reinstall default apps on Galaxy S3 before updating to Jelly Bean [migrated]

    - by Bruno-P
    I want to update my Galaxy S3 to Jelly Bean but after downloading the firmware using Kies, it starts updating, but then it stops with a "dead" Android with a red triangle icon. I think it's because I have removed some default apps like ChatOn and Yahoo widgets. Is there any way to get them back or to install the official Jelly Bean update without a factory reset? I don't want to reinstall my apps again and lose my settings each time I need to update the OS (I also don't want bloatware apps that are pre-installed). Any ideas?

    Read the article

  • Website ocasionally does not load on first click

    - by tfe
    Today I noticed that my website hosted on a virtual server ocasionally does not load on first click. I click on some link, browser starts loading page but nothing loads and does not not appear any error message (like "connection reset by peer etc). Nothing. When I click the same link again, page loads immediately. The same situation on 2 computers in different browsers. It happends not always, maybe on each 20... or 30 click. Sites from other servers load without this problem. Any ideas what can cause this problem?

    Read the article

  • USB webcam just works once and next time I've to reboot

    - by user30262
    I'm using Ubuntu 9.10, and a usb webcam that is shown as 'Bus 001 Device 005: ID 0ac8:3450 Z-Star Microelectronics Corp.' by lsusb. The problem is that on connecting the cam, it just works with the first program I start (skype, tokbox, messenger), and if I disconnect it or switch to another program, it stops to work and I have to restart my computer to make it work again. Has anyone else noticed this behaviour? Is there some good solution to reset the camera without rebooting to make it work again?

    Read the article

  • Resizing 2 partitions (NTFS and ReiserFS3)

    - by steven
    When creating a Win7 and Gentoo setup I miss allocated the space needed for Windows and Linux. I have a 320 gb drive and created a 40gb partition on Win7 and used the rest of the space on Linux. Now I need about 70gbs on the NTFS partition. Are there any tools that will shrink the ReiserFS3 partition? (It is using about 80gbs and has the reset free), while growing the NTFS partition? If I have to clone, does the tool copy freespace inside the image? I would prefer this not happen as that I'm sort on backup space. [I can handle a 100-150gb of images, but I can't copy the entire HD]

    Read the article

  • What can be inside a class that derive from OmniAuth?

    - by Richard77
    I have the following class class Identity < OmniAuth:: Identity:: Models:: ActiveRecord attr_accessible :email, :name, :password_digest, :password, :password_confirmation end I wonder if the above properties are the only ones allowed for a class that derive from a OmniAuth. I wish I could add some more like FirstName, LastName, age, gender, and so on. Do I need to create an other model for those properties or can I just add them to the Identity model? Thanks for helping.

    Read the article

  • When I connect my iPhone 3GS to my PC, iTunes "freezes": Activity Monitor shows iTunes as "Not Respo

    - by reachmanoj74
    When I connect my iPhone 3GS to my PC, iTunes "freezes": Activity Monitor shows iTunes as "Not Responding". The iPhone indicates that it is being charged, and otherwise seems normal. When I disconnect the iPhone, iTunes immediately returns to normal operation. Connect again, and instant freeze again. I have rebooted the PC, uninstalled iTunes and reinstalled it and have reset the iPhone. No help. Everything worked fine yesterday. I haven't installed software or changed anything since the last time I synced. iPhone 3GS is running version 3.1.2(7D11). It is jailbroken.

    Read the article

  • Declare a Dictionary inside a static class

    - by Ngu Soon Hui
    How to declare a static dictionary object inside a static class? I tried public static class ErrorCode { public const IDictionary<string , string > ErrorCodeDic =new Dictionary<string, string>() { {"1","User name or password problem"} }; } But the compiler complains that "A const field of a reference type other than string can only be initialized with null".

    Read the article

  • Rails: How to to download a file from a http and save it into database

    - by Chris
    Hi, i would like to create a Rails controller that download a serie of jpg files from the web and directly write them into database as binary (I am not trying to do an upload form) Any clue on the way to do that ? Thank you Edit : Here is some code I already wrote using attachment-fu gem : http = Net::HTTP.new('awebsite', 443) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE http.start() { |http| req = Net::HTTP::Get.new("image.jpg") req.basic_auth login, password response = http.request(req) attachment = Attachment.new(:uploaded_data => response.body) attachement.save } And I get an "undefined method `content_type' for #" error

    Read the article

  • Move MySQL master

    - by Noodles
    I currently have a master db server (lets call it db1) and 6 slaves (slave1-6). I've setup a new server (db2) as a slave of db1 and it's in sync. I want to change all the slaves to use db2 instead of db1, but with minimal downtime/data loss. At the moment the only way I can think of doing it is shutting down our website (so data stops being written to db1), waiting until all the slaves are up to date, flush logs on db1, shut it down. Reset master on db2, change all slaves to point to db2 with log position = 0. Is this the right way to do it or is there a way to do it without taking the site offline?

    Read the article

  • Using PHP5s SOAP Client to send data to an ASP/.NET based SOAP server.

    - by user325143
    I am trying to write a snippet of PHP to connect to a third party's API via SOAP to enter some data into their database. The API requires me to pass several mandatory fields for every call (username, password, companyid, entitytype) in addition to the mandatory data fields. It also requires me to call the "ValidateEntity" funciton before calling the "CreateEntity" function. Documentation can be found here: http://wiki.agemni.com/Getting_Started/APIs/Database_API I have never worked with SOAP before, so I am very new to this. Here is what I have so far: error_reporting(E_ALL); ini_set('display_errors', '1'); $client = new SoapClient("http://agemni.com/AgemniWebservices/service1.asmx?WSDL", array('trace'=> true)); $options = array( 'username' => "myuser", 'password' => "mypassword", 'companyid' => myID, 'entitytype' => 2 ); $params = array( 'fname' => "John", 'lname' => "Doe", 'phone' => "859-333-3333", 'zip' => "40332", 'area id' => "12345", 'lead id' => "28222", 'contactdate' => "4/10/2010" ); $validate = $client->__soapCall("ValidateEntity", array($params), array($options)); $client->__soapCall("CreateEntity", array($params), array($options)); echo "<pre>"; var_dump($client-> __getLastRequestHeaders()); var_dump($client-> __getLastRequest()); var_dump($client-> __getLastResponseHeaders()); var_dump($client-> __getLastResponse()); var_dump($result); echo "</pre>"; Upon executing this code, I get the following error: Fatal error: Uncaught SoapFault exception: [Client] SOAP-ERROR: Encoding: object hasn't 'objecttype' property in /www/tmp/index-soap.php:24 Stack trace: #0 /www/tmp/index-soap.php(24): SoapClient->__soapCall('ValidateEntity', Array) #1 {main} thrown in /www/stealth/tmp/index-soap.php on line 24 I guess my question is.. am I even going about doing this the right way? I know this is a very broad question, but I appreciate any advice you can give me about making this work. Please let me know if you require more detail. Thanks!

    Read the article

  • Show or hide fields depending on the Acl9 role - Ruby on Rails

    - by Michaël
    Hi, I am using Acl9 to manage the roles and I want to hide the checkbox usertype if the user has the role :customer and show it if the role is :manager. I want that just the :manager can edit all the fields and some for the :customer. Thank you for your help! <h1>Editing user</h1> <% form_for(@user) do |f| %> <%= f.error_messages %> <p> <%= f.label :usertype %><br /> <%= f.check_box :usertype %> </p> <p> <%= f.label :surname %><br /> <%= f.text_field :surname %> </p> <p> <%= f.label :firstname %><br /> <%= f.text_field :firstname %> </p> <p> <%= f.label :phone %><br /> <%= f.text_field :phone %> </p> <p> <%= f.label :email %><br /> <%= f.text_field :email %> </p> <p> <%= f.label :registrationdate %><br /> <%= f.datetime_select :registrationdate %> </p> <p> <%= f.label :login %><br /> <%= f.text_field :login %> </p> <p> <%= f.label :password %><br /> <%= f.text_field :password %> </p> <p> <%= f.submit 'Update' %> </p> <% end %> <%= link_to 'Show', @user %> | <%= link_to 'Back', users_path %>

    Read the article

  • C# ASP.Net WebForm Membership Extra User Details (Profile)

    - by user1638362
    I'm learning how to use the ASP.net membership, when a user registers they just create a username and password, however i want to create a page on my website called "profile" where they can fill in extra details such as firstname, lastname, date of birth ect. However i don't see where i can place this in the asp.net membership database. Theres an asp.net_profile table however i'm not sure how this works. Could someone please explain how i can do this?

    Read the article

  • How to implement a login page in a GWT app?

    - by Gatis
    My WebApp needs to authenticate user before allowing any sort of access. The scenario I'm trying to implement is a login page with username and password fields. Once user hits "send" button, a sign like "Verifing..." should be shown up while an RPC call verifies credentials. In case of success, load the main app screen. What is the best way to implement that?

    Read the article

  • How to create a login with struts2 and ldap?

    - by jl
    Hi, I need to create a login and account validation using struts 2 and ldap, so the flow would be: Display login page User inputs his username and password Validates user's existence in ldap Redirect to welcome page with message and user's name How should I get it done in Struts 2 and Ldap? Thank you.

    Read the article

  • Sending E-mail from the client

    - by peterpan764
    hi guys i need some help the vb.net. my problem is that i have got an formular with "name" "password" "e-mail" and some other.... i want that the client file in his for example name and i want to recieve an e-mail at my e-emil acc. Can somebody help my please?

    Read the article

  • Execute a command using php under ssh2 in php

    - by Mervyn
    Using Mint terminal my script connects using ssh2_connect and ssh2_auth-password. When am logged in successfully I want to run a command which will give me the hardware cpu. Is there a way I can use to exec the command in my script then show the results. I have used system and exec for pinging. if i was in the terminal i do the login. then type "get hardware cpu" in the terminal it would look like this: Test~ $ get hardware cpu

    Read the article

< Previous Page | 322 323 324 325 326 327 328 329 330 331 332 333  | Next Page >