ASP.NET

deny tag of web.config not working on production server

17-Jan-10 22:14

Also justhave a look

Cheers!!
Brij

THE SK17-Jan-10 18:16

THE SK

17-Jan-10 18:16

Hi All

I have a website on which I am using following setting in web.config

1. to use forms authentication

<authentication mode="Forms">
      <forms name="MyApplication" loginUrl="/_layouts/CommerceServer/CommerceloginPage.aspx" />
    </authentication>

2.To secure a folder named MyAcc from anonymous access

<location path="Pages/MyAcc" allowOverride="false">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>

3.The membership provider

<membership defaultProvider="UpmProvider">
      <providers>
        <add applicationName="MyApplication"
 enablePasswordRetrieval="false"
 enableEmailAddress="true" 
 name="UpmProvider" 
  type="Microsoft.CommerceServer.Runtime.Profiles.UpmMembershipProvider,Microsoft.CommerceServer.Runtime,
 Version=6.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" enablePasswordReset="true" requiresQuestionAndAnswer="false"
passwordFormat="Hashed"
 PasswordStrengthRegularExpression="^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,50}$" />

      </providers>
    </membership>

Now the challenge is on my development server the deny tag works fine i.e when an anonymous
user try to access pages
which are there in MyAcc folder,the user gets redirected
to login page.

On the other hand on production site,the anonymous user is able to access the pages of MyAcc folder.

Please suggest what could be wrong.Is there any other way to secure thge pages from anonymnous access.

Thanks

Regards
Sandeep Kalra

modified on Monday, January 18, 2010 12:29 AM

handle backspace key

hi_everybody17-Jan-10 1:19

hi_everybody

17-Jan-10 1:19

Hi,
hi i am new in asp.net.
I have problem that at the time of using website if i press backspace key then it shows the previous page, i want to an alert message if user press backspace key at the time using website...

thanks

Brij17-Jan-10 1:56

17-Jan-10 1:56

Use the following JS function

function checkBackSpace()
  {
           if(event.keyCode==8)
           {
                  alert('You pressed BackSpace');
                 return false;
           }
  }

and put it on body tag as

<body onkeydown="return checkBackSpace();">

Now you will get a message.

Cheers!!
Brij

Prosanta Kundu online17-Jan-10 17:08

Prosanta Kundu online

17-Jan-10 17:08

I think Brij is right. But a little changes are required in this code. Otherwise it will alert when user hits backspace key in a textbox. So here is the answer below

In JS code
---------------------
function checkBackSpace(event)
{
      event = event || window.event;
      var target = event.target || event.srcElement;

      if(event.keyCode==8 && (!(target.type =="text" || target.type =="textarea"))
      {
            alert('You pressed BackSpace');
            return false;
      }
      return true;
}

and put it on body tag as
-------------------------------
<body   onkeydown="return checkBackSpace(event);>

Cheers
Prosanta

Brij17-Jan-10 22:08

17-Jan-10 22:08

Thanks for your update. Smile | :)

Cheers!!
Brij

hi_everybody17-Jan-10 22:19

hi_everybody

17-Jan-10 22:19

thanks a lot you both Brij and Prosanta...

hi_everybody19-Jan-10 1:02

hi_everybody

19-Jan-10 1:02

hi its working but there is some error when i navigating using tab key....
it throughs error related object...
why? how i handle it?

Still having problems with ASP.NET [modified] [Solved]

Prosanta Kundu online20-Jan-10 16:53

Prosanta Kundu online

20-Jan-10 16:53

Hi
here is your code below

function checkBackSpace(event)
{
         event = event || window.event;
         var target = event.target || event.srcElement;

         if(event.keyCode==8)
         {
               if((!(target.type =="text" || target.type =="textarea"))
               {
                     alert('You pressed BackSpace');
                     return false;
                  }
         }
         return true;
}

Cheers
Prosanta

theOzLizard16-Jan-10 13:57

theOzLizard

16-Jan-10 13:57

Please follow the story, I don't think there is much more to get to the bottom of this problem just need some more ideas...

ASP.NET Problem

theLizard

modified on Sunday, January 17, 2010 5:32 PM

Re: Still having problems with ASP.NET [modified] [Solved]

theOzLizard17-Jan-10 11:48

theOzLizard

17-Jan-10 11:48

For those that want to know.

The problem was not my application as I knew all along, the problem turned out to be how the initial page was called in the various browsers.

If I omitted the www. of default.com/mypage.aspx the Session ID was created for mysite.com/default.aspx but when I called the response page via the call back, the window.location.url redirected to www.mysite.com/responsepage.aspx a new session was started with new session objects resulting in the strange behavior.

To those who answered, thanks your input did help in pointing me in the right direction.

theLizard

Can I embed an ActiveX control in a ASP.NET MVC View?

Nirav Doshi16-Jan-10 6:33

Nirav Doshi

16-Jan-10 6:33

Hi,

I'm trying to embed an ActiveX control in a website developed using the Sharp (S#arp) Architecture Framework[^], which leverages the ASP.NET MVC Framework & NHibernate. However, I'm struggling to get it to work. Sigh | :sigh:

Is it possible to embed an ActiveX control?

I'm also thinking of an alternative, where I could add a Web form to the project & that could contain the ActiveX. (I suppose it should work). Any alternative ideas if its not possible to embed an ActiveX control in a ASP.NET MVC view?

Thanks,

ND

_{* Blood donation is the superior'est form of donation, it can save lives. Celebrate special occasions, like your birthdays, by donating blood. *}

Re: Can I embed an ActiveX control in a ASP.NET MVC View?

April Fans18-Jan-10 15:02

April Fans

18-Jan-10 15:02

Hi, you should check IIS: the upper limit of thread, then check whether you have closed every transaction in your code or not.

Good luck.

April

Comm100 - Leading Live Chat Software Provider

modified 27-May-14 8:53am.

multi user issue

aamirzada15-Jan-10 19:21

aamirzada

15-Jan-10 19:21

i have upload a website which run fine but it upon show an error message which show that page cann't b displayed due to high trafic while there are only 15 to 20 user accessing the sites.

amirzada

Re: multi user issue

Brij15-Jan-10 21:14

15-Jan-10 21:14

This is a performance issue.Monitor the performance of your application/webserver,then you'll get to know the actual issue.
You can also refer Click hereCheers!!
Brij

Re: multi user issue

aamirzada27-Jan-10 21:20

aamirzada

27-Jan-10 21:20

i have check ur solution but it does not work. the message is shown when three people are accessing the site often it shows the message when there are only two users.

amirzada

Session usage

Mycroft Holmes15-Jan-10 11:27

Mycroft Holmes

15-Jan-10 11:27

Is it reasonable to put my objects into the Session between pages. I have reduced my objects to fairly small size with no lists or collections, generally between 4 and 10 fields. I am currently pushing these into the Session object assuming that this is quicker than a trip to the database (and will it piss off the host DiscountASP.net).

What is the recommended method of transferring IDs between pages, I am currently using the URL but I know this is not good as it exposes details about the system that should not be exposed

Never underestimate the power of human stupidity
RAH

Ennis Ray Lynch, Jr.15-Jan-10 11:59

Ennis Ray Lynch, Jr.

15-Jan-10 11:59

Transferring id values is OK so long as they are secured otherwise, ie if you use id=7 a user can't type id=8 and get that id unless they have permission. Often you can use post parameters to "hide" the information from the user but the security still needs to exist.

While it is very reasonable to put some objects in Session I prefer hitting the db and having completely stateless ASP.NET applications. Any host that doesn't want you using their DB has problems.

Also, one pattern I use when using Session is to have a SessionManager class and I require that all access to properties in the Session be from that class. That way it is easy to see what is in the Session and Where, etc.

Need custom software developed? I do custom programming based primarily on MS tools with an emphasis on C# development and consulting.

A man said to the universe:
"Sir I exist!"
"However," replied the universe,
"The fact has not created in me
A sense of obligation."
--Stephen Crane

N a v a n e e t h15-Jan-10 18:00

N a v a n e e t h

15-Jan-10 18:00

Mycroft Holmes wrote:
I have reduced my objects to fairly small size with no lists or collections, generally between 4 and 10 fields.

Looks fine to me. Make sure you remove them once you are done and your session don't have huge timeout limits. Performance will impact badly only when site has got huge traffic. In all other cases, it should be fine.

Mycroft Holmes wrote:
What is the recommended method of transferring IDs between pages, I am currently using the URL but I know this is not good as it exposes details about the system that should not be exposed

If Ids are secured, don't pass it through URL. If not, passing through URL is fine. It will produce hackable URLs and hackable URLs are very helpful.

Smile | :)

Best wishes,
Navaneeth

Mycroft Holmes15-Jan-10 21:26

Mycroft Holmes

15-Jan-10 21:26

N a v a n e e t h wrote:
If Ids are secured,

Can you elaborate on securing the IDs, currently they are simply integers (?CustomerID=1) in the URL

Never underestimate the power of human stupidity
RAH

N a v a n e e t h16-Jan-10 5:38

N a v a n e e t h

16-Jan-10 5:38

Mycroft Holmes wrote:
Can you elaborate on securing the IDs

Well, if you are sending secured information through URL, few things should be taken care.

Encrypt the values and send the encrypted text. The encrypted text may have special characters and you probably have to encode it before using in URL.
A second level of check should be performed after you receive the id. For example, you have a page that allows editing personal information of current user with a url like (edit.aspx?id=20) where 20 is the current user's id. Since the id is clearly visible, a user can change it to 30 and edit that users personal information. So after receiving the id, you need to check whether the current user logged in has the same id specified in the URL. It is good to do this second level of checking even the values are encrypted.

After all, if you can, avoid passing secured information through URL. Smile | :)

Best wishes,
Navaneeth