Search Results

Search found 18347 results on 734 pages for 'generate password'.

Page 398/734 | < Previous Page | 394 395 396 397 398 399 400 401 402 403 404 405  | Next Page >

  • C# ASP.Net WebForm Membership Extra User Details (Profile)

    - by user1638362
    I'm learning how to use the ASP.net membership, when a user registers they just create a username and password, however i want to create a page on my website called "profile" where they can fill in extra details such as firstname, lastname, date of birth ect. However i don't see where i can place this in the asp.net membership database. Theres an asp.net_profile table however i'm not sure how this works. Could someone please explain how i can do this?

    Read the article

  • SINGLE SIGN ON SECURITY THREAT! FACEBOOK access_token broadcast in the open/clear

    - by MOKANA
    Subsequent to my posting there was a remark made that this was not really a question but I thought I did indeed postulate one. So that there is no ambiquity here is the question with a lead in: Since there is no data sent from Facebook during the Canvas Load process that is not at some point divulged, including the access_token, session and other data that could uniquely identify a user, does any one see any other way other than adding one more layer, i.e., a password, sent over the wire via HTTPS along with the access_toekn, that will insure unique untampered with security by the user? Using Wireshark I captured the local broadcast while loading my Canvas Application page. I was hugely surprised to see the access_token broadcast in the open, viewable for any one to see. This access_token is appended to any https call to the Facebook OpenGraph API. Using facebook as a single click log on has now raised huge concerns for me. It is stored in a session object in memory and the cookie is cleared upon app termination and after reviewing the FB.Init calls I saw a lot of HTTPS calls so I assumed the access_token was always encrypted. But last night I saw in the status bar a call from what was simply an http call that included the App ID so I felt I should sniff the Application Canvas load sequence. Today I did sniff the broadcast and in the attached image you can see that there are http calls with the access_token being broadcast in the open and clear for anyone to gain access to. Am I missing something, is what I am seeing and my interpretation really correct. If any one can sniff and get the access_token they can theorically make calls to the Graph API via https, even though the call back would still need to be the site established in Facebook's application set up. But what is truly a security threat is anyone using the access_token for access to their own site. I do not see the value of a single sign on via Facebook if the only thing that was established as secure was the access_token - becuase for what I can see it clearly is not secure. Access tokens that never have an expire date do not change. Access_tokens are different for every user, to access to another site could be held tight to just a single user, but compromising even a single user's data is unacceptable. http://www.creatingstory.com/images/InTheOpen.png Went back and did more research on this: FINDINGS: Went back an re ran the canvas application to verify that it was not any of my code that was not broadcasting. In this call: HTTP GET /connect.php/en_US/js/CacheData HTTP/1.1 The USER ID is clearly visible in the cookie. So USER_ID's are fully visible, but they are already. Anyone can go to pretty much any ones page and hover over the image and see the USER ID. So no big threat. APP_ID are also easily obtainable - but . . . http://www.creatingstory.com/images/InTheOpen2.png The above file clearly shows the FULL ACCESS TOKEN clearly in the OPEN via a Facebook initiated call. Am I wrong. TELL ME I AM WRONG because I want to be wrong about this. I have since reset my app secret so I am showing the real sniff of the Canvas Page being loaded. Additional data 02/20/2011: @ifaour - I appreciate the time you took to compile your response. I am pretty familiar with the OAuth process and have a pretty solid understanding of the signed_request unpacking and utilization of the access_token. I perform a substantial amount of my processing on the server and my Facebook server side flows are all complete and function without any flaw that I know of. The application secret is secure and never passed to the front end application and is also changed regularly. I am being as fanatical about security as I can be, knowing there is so much I don’t know that could come back and bite me. Two huge access_token issues: The issues concern the possible utilization of the access_token from the USER AGENT (browser). During the FB.INIT() process of the Facebook JavaScript SDK, a cookie is created as well as an object in memory called a session object. This object, along with the cookie contain the access_token, session, a secret, and uid and status of the connection. The session object is structured such that is supports both the new OAuth and the legacy flows. With OAuth, the access_token and status are pretty much al that is used in the session object. The first issue is that the access_token is used to make HTTPS calls to the GRAPH API. If you had the access_token, you could do this from any browser: https://graph.facebook.com/220439?access_token=... and it will return a ton of information about the user. So any one with the access token can gain access to a Facebook account. You can also make additional calls to any info the user has granted access to the application tied to the access_token. At first I thought that a call into the GRAPH had to have a Callback to the URL established in the App Setup, but I tested it as mentioned below and it will return info back right into the browser. Adding that callback feature would be a good idea I think, tightens things up a bit. The second issue is utilization of some unique private secured data that identifies the user to the third party data base, i.e., like in my case, I would use a single sign on to populate user information into my database using this unique secured data item (i.e., access_token which contains the APP ID, the USER ID, and a hashed with secret sequence). None of this is a problem on the server side. You get a signed_request, you unpack it with secret, make HTTPS calls, get HTTPS responses back. When a user has information entered via the USER AGENT(browser) that must be stored via a POST, this unique secured data element would be sent via HTTPS such that they are validated prior to data base insertion. However, If there is NO secured piece of unique data that is supplied via the single sign on process, then there is no way to guarantee unauthorized access. The access_token is the one piece of data that is utilized by Facebook to make the HTTPS calls into the GRAPH API. it is considered unique in regards to BOTH the USER and the APPLICATION and is initially secure via the signed_request packaging. If however, it is subsequently transmitted in the clear and if I can sniff the wire and obtain the access_token, then I can pretend to be the application and gain the information they have authorized the application to see. I tried the above example from a Safari and IE browser and it returned all of my information to me in the browser. In conclusion, the access_token is part of the signed_request and that is how the application initially obtains it. After OAuth authentication and authorization, i.e., the USER has logged into Facebook and then runs your app, the access_token is stored as mentioned above and I have sniffed it such that I see it stored in a Cookie that is transmitted over the wire, resulting in there being NO UNIQUE SECURED IDENTIFIABLE piece of information that can be used to support interaction with the database, or in other words, unless there were one more piece of secure data sent along with the access_token to my database, i.e., a password, I would not be able to discern if it is a legitimate call. Luckily I utilized secure AJAX via POST and the call has to come from the same domain, but I am sure there is a way to hijack that. I am totally open to any ideas on this topic on how to uniquely identify my USERS other than adding another layer (password) via this single sign on process or if someone would just share with me that I read and analyzed my data incorrectly and that the access_token is always secure over the wire. Mahalo nui loa in advance.

    Read the article

  • Unique text field in MySQL and php

    - by Jonathan
    I've created a salt using; md5(rand(0,10000000)); (there is probably a better way?) There doesn't seem to be possible to make a text field unique in MYSQL. So how do I check if the salt has already been used for a previous user? Or should I generate the salt based on the current date/time? as it is impossible for 2 users to register at exactly the same time correct?

    Read the article

  • Javascript timezone solution needed

    - by user198729
    I have unix timestamps from time zone X which is not known, the current timestamp(now()) in TZ X is known 1275143019, how to approach a javascript function so that it can generate the datetime in the users current TZ in the format 2010-05-29 15:32:35 ?

    Read the article

  • Recommended ways of Importing a maven project to IDE ?

    - by Tony
    Many IDEs supports to import maven projects directly, but maven has a maven-eclipse-plugin, when you run : mvn eclipse:eclipse It will generate eclipse project settings ,then you can import as generic eclipse project. Which one is better? I prefer the first one, as my IDE is eclipse 3.5 shiped with WTP 3.1 and m2eclipse, I don't know if maven-eclipse-plugin support WTP 3.1 project settings ? If I don't import correct project settings, I don't think eclipse will recognize my project,when I deploy a web application, it ususally can't find webroot folder.

    Read the article

  • Can you use Ant to Build/Modify XML files?

    - by user369701
    I am quite new to ant and have been looking at the tasks. I am trying to generate an xml file. Do I need to call an external process or does ant have some way to do this? It could be as simple as sending a string to a txt file and saving it as a .xml. Is it possible?

    Read the article

  • What can be inside a class that derive from OmniAuth?

    - by Richard77
    I have the following class class Identity < OmniAuth:: Identity:: Models:: ActiveRecord attr_accessible :email, :name, :password_digest, :password, :password_confirmation end I wonder if the above properties are the only ones allowed for a class that derive from a OmniAuth. I wish I could add some more like FirstName, LastName, age, gender, and so on. Do I need to create an other model for those properties or can I just add them to the Identity model? Thanks for helping.

    Read the article

  • Function for creating color wheels

    - by lbrandy
    This is something I've pseudo-solved many times and never quite found a solution that's stuck with me. The problem is to come up with a way to generate N colors that are as distinguishable as possible where N is a parameter.

    Read the article

  • Rails: How to to download a file from a http and save it into database

    - by Chris
    Hi, i would like to create a Rails controller that download a serie of jpg files from the web and directly write them into database as binary (I am not trying to do an upload form) Any clue on the way to do that ? Thank you Edit : Here is some code I already wrote using attachment-fu gem : http = Net::HTTP.new('awebsite', 443) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE http.start() { |http| req = Net::HTTP::Get.new("image.jpg") req.basic_auth login, password response = http.request(req) attachment = Attachment.new(:uploaded_data => response.body) attachement.save } And I get an "undefined method `content_type' for #" error

    Read the article

  • Does the compiler optimize the function parameters passed by value?

    - by Naveen
    Lets say I have a function where the parameter is passed by value instead of const-reference. Further, lets assume that only the value is used inside the function i.e. the function doesn't try to modify it. In that case will the compiler will be able to figure out that it can pass the value by const-reference (for performance reasons) and generate the code accordingly? Is there any compiler which does that?

    Read the article

  • Create Linework/Geometry Using Text Style in AutoCAD

    - by Kratz
    I'm working in AutoCAD using the ObjectARX .Net API. Is there a way to either create text using lines/curves/polylines, or explode an existing text object into lines/ect? Prefereable I would like to be able to generate linework based on an exsiting AutoCAD text style. Edit: I was able to find the source for the TxtExp command here . However its in AutoCADs own Lisp language, and I can't make heads or tails of it.

    Read the article

  • Show or hide fields depending on the Acl9 role - Ruby on Rails

    - by Michaël
    Hi, I am using Acl9 to manage the roles and I want to hide the checkbox usertype if the user has the role :customer and show it if the role is :manager. I want that just the :manager can edit all the fields and some for the :customer. Thank you for your help! <h1>Editing user</h1> <% form_for(@user) do |f| %> <%= f.error_messages %> <p> <%= f.label :usertype %><br /> <%= f.check_box :usertype %> </p> <p> <%= f.label :surname %><br /> <%= f.text_field :surname %> </p> <p> <%= f.label :firstname %><br /> <%= f.text_field :firstname %> </p> <p> <%= f.label :phone %><br /> <%= f.text_field :phone %> </p> <p> <%= f.label :email %><br /> <%= f.text_field :email %> </p> <p> <%= f.label :registrationdate %><br /> <%= f.datetime_select :registrationdate %> </p> <p> <%= f.label :login %><br /> <%= f.text_field :login %> </p> <p> <%= f.label :password %><br /> <%= f.text_field :password %> </p> <p> <%= f.submit 'Update' %> </p> <% end %> <%= link_to 'Show', @user %> | <%= link_to 'Back', users_path %>

    Read the article

  • Web service security not working. Java

    - by Nitesh Panchal
    Hello, I have a ejb module which contains my ejbs as well as web services. I am using Netbeans 6.8 and Glassfish V3 I right clicked on my web service and clicked "edit web service attributes" and then checked "secure service" and then selected keystore of my server. This is my sun-ejb-jar.xml file :- <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE sun-ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd"> <sun-ejb-jar> <security-role-mapping> <role-name>Admin</role-name> <group-name>Admin</group-name> </security-role-mapping> <security-role-mapping> <role-name>General</role-name> <group-name>General</group-name> </security-role-mapping> <security-role-mapping> <role-name>Member</role-name> <group-name>Member</group-name> </security-role-mapping> <enterprise-beans> <ejb> <ejb-name>MemberBean</ejb-name> <webservice-endpoint> <port-component-name>wsMember</port-component-name> <login-config> <auth-method>BASIC</auth-method> <realm>file</realm> </login-config> </webservice-endpoint> </ejb> </enterprise-beans> </sun-ejb-jar> Here MemberBean is my ejb and wsMember is my webservice. Then i made another project and added web service client and again right clicked on "edit web service attributes" and gave password as test and test. This username and password (test) is in Glassfish server in file realm. But when i try to invoke my webservice i always get SEC5046: Audit: Authentication refused for [test]. SEC1201: Login failed for user: test What am i doing wrong? Am i missing something?

    Read the article

  • Using PHP5s SOAP Client to send data to an ASP/.NET based SOAP server.

    - by user325143
    I am trying to write a snippet of PHP to connect to a third party's API via SOAP to enter some data into their database. The API requires me to pass several mandatory fields for every call (username, password, companyid, entitytype) in addition to the mandatory data fields. It also requires me to call the "ValidateEntity" funciton before calling the "CreateEntity" function. Documentation can be found here: http://wiki.agemni.com/Getting_Started/APIs/Database_API I have never worked with SOAP before, so I am very new to this. Here is what I have so far: error_reporting(E_ALL); ini_set('display_errors', '1'); $client = new SoapClient("http://agemni.com/AgemniWebservices/service1.asmx?WSDL", array('trace'=> true)); $options = array( 'username' => "myuser", 'password' => "mypassword", 'companyid' => myID, 'entitytype' => 2 ); $params = array( 'fname' => "John", 'lname' => "Doe", 'phone' => "859-333-3333", 'zip' => "40332", 'area id' => "12345", 'lead id' => "28222", 'contactdate' => "4/10/2010" ); $validate = $client->__soapCall("ValidateEntity", array($params), array($options)); $client->__soapCall("CreateEntity", array($params), array($options)); echo "<pre>"; var_dump($client-> __getLastRequestHeaders()); var_dump($client-> __getLastRequest()); var_dump($client-> __getLastResponseHeaders()); var_dump($client-> __getLastResponse()); var_dump($result); echo "</pre>"; Upon executing this code, I get the following error: Fatal error: Uncaught SoapFault exception: [Client] SOAP-ERROR: Encoding: object hasn't 'objecttype' property in /www/tmp/index-soap.php:24 Stack trace: #0 /www/tmp/index-soap.php(24): SoapClient->__soapCall('ValidateEntity', Array) #1 {main} thrown in /www/stealth/tmp/index-soap.php on line 24 I guess my question is.. am I even going about doing this the right way? I know this is a very broad question, but I appreciate any advice you can give me about making this work. Please let me know if you require more detail. Thanks!

    Read the article

  • How to create a login with struts2 and ldap?

    - by jl
    Hi, I need to create a login and account validation using struts 2 and ldap, so the flow would be: Display login page User inputs his username and password Validates user's existence in ldap Redirect to welcome page with message and user's name How should I get it done in Struts 2 and Ldap? Thank you.

    Read the article

  • How to link a UIViewController to a NIB file?

    - by jcdmb
    Hi everyone, I'm reading O'reilly's Learning iPhone Programming and on page 79 it says I have to create a new file (UIViewController subclass) and thick the checkbox to ask Xcode to generate an associated NIB file. The problem is: I do not have this option in my XCode 3.1 (this options is from XCode 3.2). So, I have to do it manually, and I don't know how. Could someone please help me? Thanks in advance!

    Read the article

< Previous Page | 394 395 396 397 398 399 400 401 402 403 404 405  | Next Page >