Search Results

Search found 31013 results on 1241 pages for 'dictionary to object'.

Page 437/1241 | < Previous Page | 433 434 435 436 437 438 439 440 441 442 443 444  | Next Page >

• SINGLE SIGN ON SECURITY THREAT! FACEBOOK access_token broadcast in the open/clear

  - by MOKANA

  Subsequent to my posting there was a remark made that this was not really a question but I thought I did indeed postulate one. So that there is no ambiquity here is the question with a lead in: Since there is no data sent from Facebook during the Canvas Load process that is not at some point divulged, including the access_token, session and other data that could uniquely identify a user, does any one see any other way other than adding one more layer, i.e., a password, sent over the wire via HTTPS along with the access_toekn, that will insure unique untampered with security by the user? Using Wireshark I captured the local broadcast while loading my Canvas Application page. I was hugely surprised to see the access_token broadcast in the open, viewable for any one to see. This access_token is appended to any https call to the Facebook OpenGraph API. Using facebook as a single click log on has now raised huge concerns for me. It is stored in a session object in memory and the cookie is cleared upon app termination and after reviewing the FB.Init calls I saw a lot of HTTPS calls so I assumed the access_token was always encrypted. But last night I saw in the status bar a call from what was simply an http call that included the App ID so I felt I should sniff the Application Canvas load sequence. Today I did sniff the broadcast and in the attached image you can see that there are http calls with the access_token being broadcast in the open and clear for anyone to gain access to. Am I missing something, is what I am seeing and my interpretation really correct. If any one can sniff and get the access_token they can theorically make calls to the Graph API via https, even though the call back would still need to be the site established in Facebook's application set up. But what is truly a security threat is anyone using the access_token for access to their own site. I do not see the value of a single sign on via Facebook if the only thing that was established as secure was the access_token - becuase for what I can see it clearly is not secure. Access tokens that never have an expire date do not change. Access_tokens are different for every user, to access to another site could be held tight to just a single user, but compromising even a single user's data is unacceptable. http://www.creatingstory.com/images/InTheOpen.png Went back and did more research on this: FINDINGS: Went back an re ran the canvas application to verify that it was not any of my code that was not broadcasting. In this call: HTTP GET /connect.php/en_US/js/CacheData HTTP/1.1 The USER ID is clearly visible in the cookie. So USER_ID's are fully visible, but they are already. Anyone can go to pretty much any ones page and hover over the image and see the USER ID. So no big threat. APP_ID are also easily obtainable - but . . . http://www.creatingstory.com/images/InTheOpen2.png The above file clearly shows the FULL ACCESS TOKEN clearly in the OPEN via a Facebook initiated call. Am I wrong. TELL ME I AM WRONG because I want to be wrong about this. I have since reset my app secret so I am showing the real sniff of the Canvas Page being loaded. Additional data 02/20/2011: @ifaour - I appreciate the time you took to compile your response. I am pretty familiar with the OAuth process and have a pretty solid understanding of the signed_request unpacking and utilization of the access_token. I perform a substantial amount of my processing on the server and my Facebook server side flows are all complete and function without any flaw that I know of. The application secret is secure and never passed to the front end application and is also changed regularly. I am being as fanatical about security as I can be, knowing there is so much I don’t know that could come back and bite me. Two huge access_token issues: The issues concern the possible utilization of the access_token from the USER AGENT (browser). During the FB.INIT() process of the Facebook JavaScript SDK, a cookie is created as well as an object in memory called a session object. This object, along with the cookie contain the access_token, session, a secret, and uid and status of the connection. The session object is structured such that is supports both the new OAuth and the legacy flows. With OAuth, the access_token and status are pretty much al that is used in the session object. The first issue is that the access_token is used to make HTTPS calls to the GRAPH API. If you had the access_token, you could do this from any browser: https://graph.facebook.com/220439?access_token=... and it will return a ton of information about the user. So any one with the access token can gain access to a Facebook account. You can also make additional calls to any info the user has granted access to the application tied to the access_token. At first I thought that a call into the GRAPH had to have a Callback to the URL established in the App Setup, but I tested it as mentioned below and it will return info back right into the browser. Adding that callback feature would be a good idea I think, tightens things up a bit. The second issue is utilization of some unique private secured data that identifies the user to the third party data base, i.e., like in my case, I would use a single sign on to populate user information into my database using this unique secured data item (i.e., access_token which contains the APP ID, the USER ID, and a hashed with secret sequence). None of this is a problem on the server side. You get a signed_request, you unpack it with secret, make HTTPS calls, get HTTPS responses back. When a user has information entered via the USER AGENT(browser) that must be stored via a POST, this unique secured data element would be sent via HTTPS such that they are validated prior to data base insertion. However, If there is NO secured piece of unique data that is supplied via the single sign on process, then there is no way to guarantee unauthorized access. The access_token is the one piece of data that is utilized by Facebook to make the HTTPS calls into the GRAPH API. it is considered unique in regards to BOTH the USER and the APPLICATION and is initially secure via the signed_request packaging. If however, it is subsequently transmitted in the clear and if I can sniff the wire and obtain the access_token, then I can pretend to be the application and gain the information they have authorized the application to see. I tried the above example from a Safari and IE browser and it returned all of my information to me in the browser. In conclusion, the access_token is part of the signed_request and that is how the application initially obtains it. After OAuth authentication and authorization, i.e., the USER has logged into Facebook and then runs your app, the access_token is stored as mentioned above and I have sniffed it such that I see it stored in a Cookie that is transmitted over the wire, resulting in there being NO UNIQUE SECURED IDENTIFIABLE piece of information that can be used to support interaction with the database, or in other words, unless there were one more piece of secure data sent along with the access_token to my database, i.e., a password, I would not be able to discern if it is a legitimate call. Luckily I utilized secure AJAX via POST and the call has to come from the same domain, but I am sure there is a way to hijack that. I am totally open to any ideas on this topic on how to uniquely identify my USERS other than adding another layer (password) via this single sign on process or if someone would just share with me that I read and analyzed my data incorrectly and that the access_token is always secure over the wire. Mahalo nui loa in advance.

  Read the article

• How do I know if an input sting is a method name of a specific class?

  - by Itay Moav

  Inside an object, I get a string and I have to know if there is a method with the same name in the current object I am in. How do I do that?

  Read the article

• Is there a straightforward way to have a ThreadStatic instance member?

  - by Dan Tao

  With the ThreadStatic attribute I can have a static member of a class with one instance of the object per thread. This is really handy for achieving thread safety using types of objects that don't guarantee thread-safe instance methods (e.g., System.Random). It only works for static members, though. Is there some corresponding attribute that provides the same functionality, but for instance members? In other words, that allows me to have one instance of the object, per thread, per instance of the containing class?

  Read the article

• jquery ui popup a YouTube Video modally

  - by BahaiResearch.com

  Is there a way to use jQueryUI to popup a YouTube video modally? Here's the YouTube code I have: <object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/DIuXtsaUDmM?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/DIuXtsaUDmM?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>

  Read the article

• Reflection: different ways to retrieve property value

  - by jules

  I'm retrieving an IEnumerable list of properties via following code: BindingFlags bindingFlag = BindingFlags.Instance | BindingFlags.Public; var dataProperties = typeof(myParentObject).GetProperties(bindingFlag); Then I'm iterating through the list and retrieving the value for each property. I've come across two different approaches to doing this, and just wondered what the difference is between them: 1) object propertyValue = property.GetGetMethod().Invoke(myObject, null); 2) object propertValue = property.GetValue(myObject, null)

  Read the article

• .htaccess & mod_rewrite for passing GET parameters

  - by Joel Alejandro

  Currently I use this to pass GET parameters on an "elegant" way: RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^([^/]*)/$ index.php?module=$1 [L] RewriteRule ^([^/]*)/([^/]*)/$ index.php?module=$1&object=$2 [L] RewriteRule ^([^/]*)/([^/]*)/([^/]*)/$ index.php?module=$1&object=$2&submodule=$3 [L] This works great for 3 parameters max., (and I'm sure it's seriously ugly). Any way to do the same thing, for n-paremeters?

  Read the article

• ImmutableDictionary has no constructors defined

  - by lukasLansky

  So, I would like to write something like this: var d = new ImmutableDictionary<string, int> { { "a", 1 }, { "b", 2 } }; (using ImmutableDictionary from System.Collections.Immutable). It seems like a straightforward usage as I am declaring all the values upfront -- no mutation there. But this gives me error: The type 'System.Collections.Immutable.ImmutableDictionary<TKey,TValue>' has no constructors defined How I am supposed to create a new immutable dictionary with static content?

  Read the article

• Find multiple line spanning text and replace using Powershell

  - by MrGrant

  Hello, I am using a regular expression search to match up and replace some text. The text can span multiple lines (may or may not have line breaks). Currently I have this: $regex = "\<\?php eval.*?\>" Get-ChildItem -exclude *.bak | Where-Object {$_.Attributes -ne "Directory"} |ForEach-Object { $text = [string]::Join("`n", (Get-Content $_)) $text -replace $RegEx ,"REPLACED"}

  Read the article

• In Ruby on Rails, how is view code able to use instance variables that are set inside the controller

  - by Jian Lin

  In Ruby on Rails, how is an ActionView object able to access the instance variables of ActionController object (how is view code able to use instance variables that are set inside the controller code)?

  Read the article

• Is it a good idea to define a class within a class in Python?

  - by rmh

  I've sometimes seen code like this: class Something(object): class Else(object): def __init__(self): pass def __init__(self): # Do something with self.Else... pass Is it a good idea to define classes inside related classes? Is this an acceptable way to group related code?

  Read the article

• Sqlalchemy enumeration/type matching?

  - by Timmy

  how do i do enumeration in sqlachemy? im using pylons if it matters. i also want to have in code to create different object depends on the enumeration, with the same parameters, but different object class.

  Read the article

• Applications of concurrent queues and stacks in .NET 4

  - by Jon Harrop

  .NET 4 includes new concurrent data structures. The Bag and Dictionary collections have obvious applications but I cannot see any use for the Queue and Stack data structures. What are people using these for? Also, I've noticed that the design based upon linked lists incurs a lot of allocation and that destroys scalability. This is surprising given that the sole purpose of these collections is multicore programming. Is this an inherent limitation or are they just badly implemented?

  Read the article

• Why doesn't HashTable.Contains() just simply return false if it is passed a null?

  - by Nate Pinchot

  I understand why passing a null to HashTable.Contains() doesn't work, but I don't understand what the point of it throwing an ArgumentNullException is - instead of just simply returning false? What is the benefit of throwing the exception (other than to make me do null checks before calling .Contains())? Caused By [System.ArgumentNullException] Key cannot be null. Parameter name: key at System.Collections.Hashtable.ContainsKey(Object key) at System.Collections.Hashtable.Contains(Object key)

  Read the article

• Are classes in Python in different files?

  - by Asaf

  Much like Java (or php), I'm use to seperating the classes to files. Is it the same deal in Python? plus, how should I name the file? Lowercase like classname.py or the same like ClassName.py? Do I need to do something special if I want to create an object from this class or does the fact that it's in the same "project" (netbeans) makes it ok to create an object from it?

  Read the article

• Guilty of unsound programming

  - by TelJanini

  I was reading Robert Rossney's entry on "What's the most unsound program you've had to maintain?" found at: (What's the most unsound program you've had to maintain?) when I realized that I had inadvertently developed a near-identical application! The app consists of an HTTPListener object that grabs incoming POST requests. Based on the information in the header, I pass the body of the request to SQL Server to perform the appropriate transaction. The requests look like: <InvoiceCreate Control="389> <Invoice> <CustomerNumber>5555</CustomerNumber> <Total>300.00</Total> <RushOrder>1</RushOrder> </Invoice> </InvoiceCreate> Once it's received by the HTTPListener object, I perform the required INSERT to the Invoice table using SQL Server's built-in XML handling functionality via a stored procedure: INSERT INTO Invoice (InvoiceNumber, CustomerNumber, Total, RushOrder) SELECT @NEW_INVOICE_NUMBER, @XML.value('(InvoiceCreate/Invoice/CustomerNumber)[1]', 'varchar(10)'), @XML.value('(InvoiceCreate/Invoice/Total)[1]', 'varchar(10)'), @XML.value('(InvoiceCreate/Invoice/Total)[1]', 'varchar(10)') I then use another SELECT statement in the same stored procedure to return the value of the new Invoice Number that was inserted into the Invoices table: SELECT @NEW_INVOICE_NUMBER FOR XML PATH 'InvoiceCreateAck' I then read the generated XML using a SQL data reader object in C# and use it as the response of the HTTPListener object. My issue is, I'm noticing that Robert is indeed correct. All of my application logic exists inside the stored procedure, so I find myself having to do a lot of error-checking (i.e. validating the customer number and invoicenumber values) inside the stored procedure. I'm still a midlevel developer, and as such, am looking to improve. Given the original post, and my current architecture, what could I have done differently to improve the application? Are there any patterns or best practices that I could refer to? What approach would you have taken? I'm open to any and all criticism, as I'd like to do my part to reduce the amount of "unsound programming" in the world.

  Read the article

• What's the __repr__ equivalence in ruby?

  - by prosseek

  The repr function is fancy as it is called when print OBJECT is used automatically? Is there a ruby equivalence for it? I thought it was to_s, but, I had p OBJECT doesn't seem to call the to_s method.

  Read the article

• C# - Does foreach() iterate by reference?

  - by sharkin

  Consider this: List<MyClass> obj_list = get_the_list(); foreach( MyClass obj in obj_list ) { obj.property = 42; } Is 'obj' a reference to the corresponding object within the list so that when I change the property the change will persist in the object instance once constructed somewhere?

  Read the article

• NHibernate: why ILifecycle.OnUpdate is not called every time ?

  - by ldp615

  NHibernate_reference.pdf, page 26: Note that ILifecycle.OnUpdate() is not called every time the object's persistent state is updated. It is called only when a transient object is passed to ISession.Update(). Why it design link that?

  Read the article

• How Do I Detect the Adobe Acrobat Version Installed in Firefox via JavaScript

  - by Snocrash

  Title says it all. I know this can be done in IE by creating an ActiveX object, but how do I do it in FF. The navigator.plugins['Adobe Acrobat'] object lets me know if it's installed or not, but it doesn't contain the version number. Any ideas?

  Read the article

• Are methods also serialized along with the data members in C#?

  - by Shaza

  Hey all, The title is obvious, I need to know if methods are serialized along with object instances in C#, I know that they don't in Java but I'm a little new to C#. If they don't, do I have to put the original class with the byte stream(serialized object) in one package when sending it to another PC? Can the original class be like a DLL file?

  Read the article

• Creating temporary user accounts - Django

  - by RadiantHex

  Hi folks, I need to setup temporary User models for each visitors, where the visitors are obviously tied by session data. I might not be aware of it, but does Django support attaching data to Anonymous users? The only way, I am currently aware of, is to use the session dictionary part of the request object. Help would be very much appreciated!

  Read the article

• how to know on which column,the sequence is applied?

  - by Vineet

  I have to fetch all sequences with their table name along with the column name on which sequence is applied .Some how i managed to fetch table name corresponding to sequence because in my data base sequence is stored with first name as table name from data dictionary(all_sequences and all_tables) . Please let me know how to fetch corresponding column name also if possible!!

  Read the article

• Error exposing event througt interface

  - by carlos

  I have this interface Interface IProDataSource Delegate Sub DstartingHandler(ByVal sender As Object, ByVal e As EventArgs) Event starting_Sinc As DstartingHandler End Interface Trying to use the intarce like this Public Class DataSource : Implements IProDataSource Public Event starting_Sinc As DstartingHandler Implements IProDataSource.starting_Sinc Public Delegate Sub DstartingHandler(ByVal sender As Object, ByVal e As EventArgs) End Class Gives me the next error Event 'starting_Sinc' cannot implement event 'starting_Sinc' on interface 'IProDataSource' because their delegate types 'DstartingHandler' and 'IProDataSource.DstartingHandler' do not match.

  Read the article

• Is there any sql interpreter for objects?

  - by Behrooz

  Is there any interpreter that takes a string or even a custom object as input and execute it on my datasource? I cannot use linq to object because query always changes and the report i'm working on, has about 6000 queries which i can reduce to 9 if i find some tool doing that for me. Opensource is very applicable. thanks in advance.

  Read the article

• How do you find out which database links are used in queries for the Oracle RDBMS?

  - by JavaRocky

  I would like to find out if any and which database links are being used, for a schema, and in which tables. Is it possible via the data dictionary somehow? Is this possible with the Oracle RDBMS?

  Read the article

< Previous Page | 433 434 435 436 437 438 439 440 441 442 443 444  | Next Page >