Search Results

Search found 88705 results on 3549 pages for 'web application security'.

Page 79/3549 | < Previous Page | 75 76 77 78 79 80 81 82 83 84 85 86  | Next Page >

• How to access system.webserver web.config node in .NET 2

  - by JK

  Are there any .NET APis that can read/update the system.webServer node in web.config? I know I can do it via reading/parsing the web.config file as xml but that's awkward. To read/update the system.web node in .NET 2 I can use: HttpModulesSection httpModulesSection = (HttpModulesSection)configuration.GetSection("system.web/httpModules"); But is there any API based way of accessing system.web/modules using .NET 2? I have to reference the .NET 2 version of system.web.configuration because I don't know in advance if my web app will be run on a server with .NET 2 or 3.5. So it is limited to .NET 2 API calls only. Thanks

  Read the article

• What web UI framework is most suitable for building dynamic pages / forms?

  - by waxwing

  Hello, We are at a stage where we are considering different Web UI frameworks (most likely component based ones such as GWT, JSF, Wicket, Vaadin, etc). One of the main use cases / constraints is that it must support generating dynamic pages. I.e., the page/form layout and components is stored in a database and is changeable at runtime, and from this pages are generated. We are also going to write static layouts, but that is not the main focus of this question. I thought maybe the user community here can share experiences of different frameworks in this context. Are there differences in ease of implementation and what is suitable?

  Read the article

• [C#] How to consume web service adheres to the Event-based Asynchronous Pattern?

  - by codemonkie

  I am following the example from http://msdn.microsoft.com/en-us/library/8wy069k1.aspx to consume a web service implemented (by 3rd party) using the Event-based Asynchronous Pattern. However, my program needs to do multiple calls to the DoStuffAsync() hence will get back as many DoStuffCompleted. I chose the overload which takes an extra parameter - Object userState to distinguish them. My first question is: Is it valid to cast a GUID to Object as below, where GUID is used to generate unique taskID? Object userState = Guid.NewGuid(); Secondly, do I need to spawn off a new thread for each DoStuffAsync() call, since I am calling it multiple times? Also, would be nice to have some online examples or tutorials on this subject. (I've been googling for it the whole day and didn't get much back) Many thanks

  Read the article

• Security in API authentication

  - by Carlos

  We are in the process of revamping our server side API, and we need to manage security. Our current model requires that a credentials object (containing user, password, and pin) be included in each method invocation. Our development team, however, has decided that we should have session objects instead (which is fine by me), but the new credentials are just a GUID. This is very different from what I've seen in other APIs in our industry, so I'm a bit concerned about how secure the new model will be. I asked them if they had analyzed both alternatives, and they said they haven't. Does anyone know if there're any clear advantages, disadvantages, risks, etc. of using a set of credentials versus just one element (complex as it may be)? PS: the communication channel would be secure in either case, and it's separate from this particular topic

  Read the article

• Are these jobs for developer or designers or for client himself? for a web-site projects [closed]

  - by jitendra

  Are these jobs for developer or for designers or for client himself? for a web-site projects. Client is asking to do all things to XHTML CSS PHP coder.. Spell checking grammar checking Descriptive alt text for big chart , graph images, technical images To write Table summary and caption Descriptive Link text Color Contrast checking Deciding in content what should be H2 ,H3, H4... and what should be <strong> or <span class="boldtext"> Meta Description and keywords for each pages Image compression To decide Filenames for images,PDf etc To decide Page's <title> for each page

  Read the article

• .NET WebService Security who can see and use.

  - by user295734

  Trying to firgure out how to test the security of a WebService. Is there some way to search a site for webservices? I have 2 applications one has a webservice and the other a reference to that service. I let visual studio build the reference in the App_WebReferences folder. The webservice works, but i started wondering, can anyone access this service from any website? If so, how can i test this? How do you search a site for webservices? Could I use jQuery/JSON code from a simple site to access a webservice? I guess if it is not secure, how do you secure a webservice?

  Read the article

• ASP.Net Roles: Page-Level Security Question

  - by jlrolin

  We're currently in the process of re-creating a brand new security model that dwarfs our existing process. Right now, we plan on grabbing a user's roles during the login process and then using a Base Page class to check if the user has the role of the corresponding page the user is navigating to. We can limit the menu's options by the user's roles as well, but we have had problems with users navigating to pages in our system by typing them in or having old bookmarks. Obviously, we need some sort of page level access. A simple function in our Base Page class that checks the role in the Arraylist against the page's assigned role would work, but I was wondering if there was any built-in functionality to support this or a cleaner solution possibly.

  Read the article

• Apache security for multi-user development web server.

  - by mrmartinblue

  I've been searching and reading through documents all morning and understand that I need to use some combination of chown and probably 'jailing' to securely give programmers access to directories on my centos webserver. Here's the situation: I have an apache web server that has any number of virtual sites located in /var/www/site1 /var/www/site2 etc.. I have different developers that need full access both ssh and vsFTP to only the site they are working on. What is the best way to create and maintain security in this scenario. My thought would be to create a new user for each coder, jail that user to the website directory they are allowed to work in, add their user to a group and set the webroot's owner to that group. Any thoughts? Good, bad, ugly? Thanks!

  Read the article

• Testing for security vulnerabilities on web applications

  - by Moak

  A lot of companies use CMS software that updates on the regular, often they are security fixes, implying that the previous version have security vulnerabilities. But most clients never upgrade this, or even the CMS has been modified so that an update would break the site. Are there sites that document these exploits, and instruct how to test for them? Or does this information not even get published? (in order not to have people try to exploit them) Also is there a generic php/js based check list to prevent hack attempts? I know about SQL injections and XSS, but I'm sure that there are more threats out there. Peace

  Read the article

• Spring security and Struts 2

  - by Thanksforfish

  I have a struts2 action with an @Secured({"ROLE_ADMIN"}) to secure the execute method. In the execute method i assign a message to a member variable of the action, then return SUCCESS and end up on the jsp page. On the page I retrieve the actions member variable with <sroperty. private String greeting; public String execute() throws Exception { this.greeting="Hello"; return SUCCESS; } // getters and setters for greeting ... <s:property value="greeting" /> The problem is when the secured annotation is present the jsp shows nothing for the member variable but when @Secured is removed the whole thing behaves properly and shows the message that was set into the member variable. It appears that the actual security is working ok but when enabled via the annotation the member variable (or maybe the instance of the action) is not making its way onto the value stack. I cant see any error messages.

  Read the article

• W3C Web Content Accessibility Guidelines 1.0, which technology could I use?

  - by vtortola

  Hi, I've a project where one of the requirements is fullfil the "W3C Web Content Accessibility Guidelines 1.0 (WCAG 1.0)". I'm now considering wich technology could I use to acomplish it, but I'm a little bit confused. Silverlight would be the easiest way, but I cannot find conclusive information about if silverlight is or isn't compilant. I've seen controls pack done in javascript that looks very nice, like DHTMLX, but again the same problem, I don't know for sure. Besides, I've always read that a website should work wihthout javascript, and use it just for improve the user experience. Thanks.

  Read the article

• Handling user security scope with nHibernate or other ORM

  - by Schotime

  How should one handle the situation where you may need to filter by a group of users. Here is the scenario. I have an administrator role in my company. I should be able to see all the data belonging to me plus all the other users who I have control over. A plain old user however should only be able to access their own data. If you are writing regular sql statements then you can have a security table with every user and who they have access too but i'm not sure how to handle this situation in the OO and ORM world. Any one dealt with this scenario in a web application using an ORM? Would love to hear your thoughts!

  Read the article

• Form Security (discussion)

  - by Eray Alakese

  I'm asking for brain storming and sharing experience. Which method you are using for form submiting security ? For example , for block automatically sended POST or GET datas, i'm using this method : // Generating random string <?php $hidden = substr(md5(microtime()) ,"-5"); ?> <form action="post.php" .... // assing this random string to a hidden input <input type="hidden" value="<?php echo $hidden;" name="secCode> // and then put this random string to a session variable $_SESSION["secCode"] = $hidden; **post.php** if ($_POST["secCode"] != $_SESSION["secCode"]) { die("You have to send this form, on our web site"); }

  Read the article

• help in security assignment

  - by scatman

  i have to write a program that sniffs network packets (part1-the simple part). and i have to update the program (part2) so that it will be able to terminate connections. the specific requirements are: construct raw packets by specifying data link layer and network layer information including appropriate source and destination MAC and IP addresses. These packets are intended to terminate the connection. To do so, you should used SOCK_RAW as the socket type to be able to set the header information by yourself. can anybody give me some ideas on the second part? should i hijack the session,apply a dos attack on one of the users?? all i need is some tips of how to terminate the connection. i am using c programming language. and this is a course assignment for the security course.

  Read the article

• Calling web service methods using URLs

  - by Alka

  Hi. So, i have a central web service that is responsible for managing other services. These services register in the main WS with their URL, leading to their own web service. what i need to do now is call the child web services from the central web service. I've searched google on how to do this but all i could find was this. I would like to register any web service and not create a web reference, as suggested in the solution i've found. How is this done without using a web reference?

  Read the article

• ASP.Net Web API Routing fails when api is created as a web application under another asp.net site in IIS

  - by neo

  I developed a rest api using ASP.net web api. When I deploy this rest api on iis, I need to create it as a web application under an asp.net web site. When I was deploying the rest api as a new web site in iis, then things worked fine. I was using the following Route api/{controller}/{id}. When I created the rest api as a web application underneath asp.net web site project, I named the web application as api. I can't access the api methods now. Can someone point what I do wrong?

  Read the article

• Running my web site in a 32-bit application pool on a 64-bit OS.

  - by Jeremy H

  Here is my setup: Dev: - Windows Server 2008 64-bit - Visual Studio 2008 - Solution with 3 class libraries, 1 web application Staging Web Server: - Windows Server 2008 R2 64-bit - IIS7.5 Integrated Application Pool with 32-bit Applications Enabled In Visual Studio I have set all 4 of my projects to compile to 'Any CPU' but when I run this web application on the web server with the 32-bit application pool it times out and crashes. When I run the application pool in 64-bit mode it works fine. The production web server requires me to run 32-bit application pool in 64-bit OS which is why I have this configured in this way on the staging web server. (I considered posting on ServerFault but the server part seems to be working fine. It is my code specifically that doesn't seem to want to run in 32-bit application pool which is why I am posting here.)

  Read the article

• Security question

  - by Syom

  in my cms i have index.php, where client must enter username and password. if they are correct, he'll moove to admin.php, where the cms is. but now hacker can enter to cms/admin.php, so my security now is awful. i know, that i can use $_SESSION variable. index.php - i can give some value to $_SESSION['success']: $_SESSION['success'] = TRUE, and in admin.php just verify it admin.php if($_SESSION['success'] == TRUE) { my script here... } else header("Location: index.php"); but i want to rich this effect without SESSION. could you give me an idea, how can i do it? thanks

  Read the article

• Running an MVC Application as a Sub-Application?

  - by ZafarYousafi

  Hi, I am facing problem in creating an mvc application as sub-application of the asp.net application. My Mvc application is doing fine in development environment and even when it is deployed normally. However whenever I tried to deploy it as a sub-application of an asp.net application like http://mainapplication/mvcsubapplication I got an error The view 'Index' or its master could not be found. The following locations were searched: ~/Views/Home/Index.aspx ~/Views/Home/Index.ascx ~/Views/Shared/Index.aspx ~/Views/Shared/Index.ascx There is no problem in view naming since application is well tested in development environment. It only happens when I tried to deploy it as sub-app. remember I am deploying on a server with IIS 7.x installed on it. Any response will be appreciated. Thanx

  Read the article

• global security manager in flex

  - by ron

  hi, I made a swf that interacts with other site on the internet (which has a crossdomainfile for me). in the main.mxml there is a definition of webservice (mx:WebService)(which is not in my domain). Therefore when loading the swf, there is a first call to crossdomainfile.xml. I put this swf on my server so that my clients can get it. When i connect to my server to download the swf, i expect to be asked if i want to allow the swf connect to foreign webservice domain. But i am not being asked. Do i always need to define exception in Global Security Settings panel? I don't want my client do define special things.. Is there a best practice for that? Why when i surfing the net other swf can do this? I read about the FlashPlayerTrust, can i define there a website i trust my swf will connect to? anyone knows?

  Read the article

• implementing security with session variables, how it is insecure

  - by haansi

  I am doing web based projects in dotnet. Currently I am implementing security using session variables. I keep current user id and user type in session and authenticate user from these session variables (say Session["UserId"],Session["UserName"] and Session["UserType"]). Please help me understand how this could be insecure. I've heard that such security can be broken and applications can be hacked very easily, like it is possible to get session id and directly connect to that session id etc. Please guide me on this.

  Read the article

• Security of PHP script, embedded or otherwise

  - by typoknig

  Hi all, I am curious about the security of PHP on an HTML webpage where PHP code is embedded (a webpage that would exist on the server as "webpage.php") or on a PHP script that may be referenced by an HTML page (that is, a PHP script that is not actually part of a webpage that exists on the server as "something.php" and is referenced by "webpage.html"). Getting to the point, let us say that if the source code of my PHP script is known by anyone it would be a very big problem. I know that when you view the source of a PHP page in a browser the PHP script is not shown, but what if the PHP server failed and the HTML still loaded (is this even possible), would a user be able to see the PHP script? To be more general, is there ANY possible way that a user could access the source of a PHP script from a web browser, and if so, how do I prevent it?

  Read the article

• Secure WS client with UsernameToken(SOAP security header)

  - by user79163

  Hi, I'm trying to secure my WS client to be able to call the WS. My code looks like this: SendSmsService smsService = new SendSmsService(); SendSms sendSMS = smsService.getSendSms(); BindingProvider stub = (BindingProvider)sendSMS; //Override endpoint with local copy of wsdl. String URL ="";//here is the wsdl url Map<String,Object> requestContext = stub.getRequestContext(); requestContext.put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, URL); //Set usernametoken URL fileURL = loader.getResource("client-config.xml"); File file = new File(fileURL.getFile()); FileInputStream clientConfig = null; try { clientConfig = new FileInputStream(file); } catch (FileNotFoundException e) { e.printStackTrace(); } XWSSecurityConfiguration config = null; try { config = SecurityConfigurationFactory.newXWSSecurityConfiguration(clientConfig); } catch (Exception e) { e.printStackTrace(); log.warn("Exception: "+e.getMessage()); } requestContext.put(XWSSecurityConfiguration.MESSAGE_SECURITY_CONFIGURATION, config); //Invoke the web service String requestId = null; try { requestId = sendSMS.sendSms(addresses, senderName, charging, message, receiptRequest); } catch (PolicyException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (ServiceException e) { // TODO Auto-generated catch block e.printStackTrace(); } and the config file looks like this: <xwss:JAXRPCSecurity xmlns:xwss="http://java.sun.com/xml/ns/xwss/config" optimize="true"> <xwss:Service> <xwss:SecurityConfiguration dumpMessages="true" xmlns:xwss="http://java.sun.com/xml/ns/xwss/config"> <xwss:UsernameToken name="username" password="password> </xwss:SecurityConfiguration> </xwss:Service> <xwss:SecurityEnvironmentHandler> util.SecurityEnvironmentHandler </xwss:SecurityEnvironmentHandler> </xwss:JAXRPCSecurity> The SecurityEnviromentHandler is a dummy class that implements javax.security.auth.callback.CallbackHandler. Authentication must be in compliance with Oasis Web Services Security Username Token Profile 1.0. But I'm constantly getting "Security header not valid" error. Where am I going wrong, can anyone tell me. I used wsimport(JAX_WS 2.1 to generate classes for my client) Note:Only thing I know about this WS is WSDL URL and user&pass for authentication

  Read the article

• PHP Security checklist (injection, sessions etc)

  - by NoviceCoding

  So what kind of things should a person using PHP and MySql be focused on to maximize security. Things I have done: -mysql_real_escape_string all inputs -validate all inputs after escaping em -Placed random alpha numerics before my table names -50character salt + Ripemd passwords Heres where I think I am slacking: -I know know nothing about sessions and securing them. How unsafe/safe is it if all you are doing is: session_start(); $_SESSION['login']= $login; and checking it with: session_start(); if(isset($_SESSION['login'])){ -I heard something about other forms of injection like cross site injection and what not... -And probably many other things I dont know about. Is there a "checklist"/Quicktut on making php secure? I dont even know what I should be worried about.I kinda regret now not building off cakephp since I am not a pro.

  Read the article

• OpenId authentication and automatic registration with Spring Security 3.0.2

  - by xlluch

  I'm implementing an app using spring security 3.0.2 with OpenId login and registration. I can login succesfully, but if the user isn't registered i want to do: 1) Get some OpenId attributes like email and name. 2) Show to the user a registration form with just these two fields and the OpenId URI filled. I've been searching a lot but i didn't find an "ellegant" way of doing this. I wonder if some of u can come out with a solution to implement this strategy in my app. Thanks in advance.

  Read the article

< Previous Page | 75 76 77 78 79 80 81 82 83 84 85 86  | Next Page >