|
normally these days many web site provide OAuth to login to their web api but how we can use the same oauth for web api ?
client will send user id and pwd in plain text to web api and web api will send those client credentials to oauth site ?
if user credentials found right then OAuth will send token to web api and web api will send token to client and from the next subsequent call web api will use the same token for each request...........am i right ?
if my thinking is wrong then just briefly tell me how oauth is used with web api and how client send their credentials and how get token etc. thanks
tbhattacharjee
|
|
|
|
|
Same as your question on HMAC.
|
|
|
|
|
just was reading a article on web API with HMAC authentication from this url http://www.piotrwalat.net/hmac-authentication-in-asp-net-web-api/
if possible some one briefly discuss what is HMAC authentication and How this type of authentication works for web api ?
what i understood from their article that client will have a secret key and when client will request web api service then they will send hash of secret key along with request and web service will compare the hash and if match then it allow to call action ?
if i understood correctly then i have some question. suppose if am sending hash of a secret key to web api then how web api know what key client have ? because if web api has to generate hash of secret key what client used for comparing at service end then web api has to know which client is sending data.
there is change of Replay attack for HMAC authentication for web api
the article raise some points which is not clear to me to prevent the chance of Replay attack for HMAC authentication for web api.
the points are
Imagine a malicious third party intercepts a valid (properly authenticated) HTTP request coming from a legitimate client
(eg. using a sniffer). Such a message can be stored and resent to our server at any time enabling attacker to repeat operations
performed previously by authenticated users. Please note that new messages still cannot be created as the attacker does not
know the secret nor has a way of retrieving it from intercepted data.
1) requests with different Date header values will have different signatures, thus attacker will not be able to modify the timestamp
we will generate hash based on secret key then how date comes to scene ? this points is not clear to me.
2) we introduce a requirement that no http request can be older than X (eg. 5) minutes - if for any reason the message is
delayed for more than that it will have to be resent with a refreshed timestamp.
point two is not clear. what this area try to mean delayed for more than that it will have to be resent with a refreshed timestamp.
tbhattacharjee
|
|
|
|
|
|
I wrote an application in asp net (3.5).
From an .aspx page should be interfaced a script in asp.
I meant that the aspx page after viewing waits X seconds and then using HTTPRequest and POST call the asp page.
In the aspx page I inserted a timer that delays the execution of the asp page X seconds.
When I use firefox working properly, while chrome is in the loop, that is the status bar see that continually draws the current page without stopping, ending only when I close the course page.
Searching the net I saw that chrome and safari have some incompatibility.
Where did I go wrong ?
What can be done to solve this problem, taking into account that I can not replace the ASP page with an .aspx, because it uses COM objects that do not know the features?
Someone enlighten me !!!
|
|
|
|
|
Good day
We have the requirement to invoke a Microsoft Outlook Meeting request from an Intranet web page without having the following (well known) message:
An ActiveX control on this page might be unsafe to interact with other parts of this page. Do you want to allow this interaction?
We want to use the standard installed (client side) Microsoft outlook libraries for that.
We do not want to relax the Local intranet Zone in IE by means of the standard resolution method of enabling the “Initialize and script ActiveX controls not marked as safe for scripting” Setting.
This is a simplified version of the code, the message is invoked by the highlighted portion
<body>
<form id="frmScheduleAMeeting" runat="server">
<div>
<input id="btnScheduleTheMeeting" type="button" value="Schedule the meeting" onclick="ScheduleTheMeeting()" style="width: 200px" />
</div>
</form>
<script type="text/javascript">
function ScheduleTheMeeting() {
var theApp;
var theMeeting;
var theApp = new ActiveXObject("Outlook.Application");
var objNS = theApp.GetNameSpace('MAPI');
var theMeeting = theApp.CreateItem(1);
theMeeting.Subject = "Will this time suit you?";
theMeeting.Location = "Your Office";
theMeeting.Recipients.Add("someone@microsoft.com");
theMeeting.Start = "01/01/2017 10:00:00"
theMeeting.End = "01/01/2017 11:00:00"
theMeeting.ReminderMinutesBeforeStart = 15;
theMeeting.BusyStatus = 1;
theMeeting.AllDayEvent = false;
theMeeting.BusyStatus = 1;
theMeeting.Save();
theMeeting.Display();
theMeeting.Recipients.ResolveAll();
theMeeting.Save();
}
</script>
</body>
We have tried to mark it safe in the registry as safe for scripting (7DD95801-9882-11CF-9FA9-00AA006C42C4) and safe for initializing from persistent data (7DD95802-9882-11CF-9FA9-00AA006C42C4).
https://msdn.microsoft.com/en-us/library/aa751977(v=VS.85).aspx
This is the registry setting we used (the one is the standard GUID for outlook, the other is the GUIDwe get when we add a reference to mso.dll in a VS.net windows form Application
[HKEY_CLASSES_ROOT\CLSID\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}]
[HKEY_CLASSES_ROOT\CLSID\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\Implemented Categories]
[HKEY_CLASSES_ROOT\CLSID\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
[HKEY_CLASSES_ROOT\CLSID\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
[HKEY_CLASSES_ROOT\CLSID\{0006F03A-0000-0000-C000-000000000046}]
[HKEY_CLASSES_ROOT\CLSID\{0006F03A-0000-0000-C000-000000000046}\Implemented Categories]
[HKEY_CLASSES_ROOT\CLSID\{0006F03A-0000-0000-C000-000000000046}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
[HKEY_CLASSES_ROOT\CLSID\{0006F03A-0000-0000-C000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
Any ideas on what else to try?
|
|
|
|
|
An ActiveX control which is not marked as "safe for scripting" cannot be access from script unless you change the security settings.
If you did manage to change it so that it was marked as "safe for scripting", then any site on the internet could use it to wreak havoc on your users' email.
Try creating your own ActiveX control to perform the specific tasks you need, and locking it down to your intranet site:
Per-Site ActiveX Controls (Internet Explorer)[^]
Alternatively, see if you can do what you need with an iCalendar file, which would have the added advantage of working in other browsers and calendars too.
GitHub - rianjs/ical.net: ical.NET - an open source iCal library for .NET[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Hello, our company website is getting hit hard from malicious bots. I wish to propose a solution which involves changes to our web.config file. The trick is that I wish for the general search engine traffic to continue; I'm just interested in preventing the malicious bots.
This is an example of what I'm seeing online:
http://blog.arvixe.com/how-to-block-malicious-bots-and-spiders-in-web-config
The author seems to be restricting all search engines. Is this correct? If so, does anyone have an alternative that will allow for general search engine traffic to visit but restrict specific malicious bots? (I'd prefer to edit the web.config, since I don't believe that malicious bots care about the robots.txt file.)
Thanks!
|
|
|
|
|
I experimented with that years ago writing a program called bot catcher or something, the program is located in my profile in articles submitted.
Over the years, the bots just change their names over and over and it becomes a circular task that chews up so much time.
I guess to anwser your question, no I have not used the web config or knew that method existed. I'm just saying that manual operation of adding bots to that config is time consuming.
IMHO, the best solution is to just block an entire country using something like a Sonic Wall.
You can create automated programs that will detect and block by IP Address, but the bot activity will detect the block and notify it's master of it; then the master will put your website on a army of machines starting in Russia, then China and so forth. If you keep blocking those, then the army grows till it wraps around the world and it's 24/7.
So after 4 years of experimenting, I finally just broke down and bought a $2K Dell NSA 2600 Sonicwall and purchased a 3 year contract to filter out bad stuff; works like a champ now and they do all the work.
Now I can focus on just writing better more efficient code to keep user data safe.
Globalism is Socialism on a planetary scale.
|
|
|
|
|
Thanks for the reply. I posted my question before understanding that my company is using SonicWALL already, and it is working well.
I appreciate your thoughts about web.config. Too bad there is no way to stop malicious bots that doesn't require spending $$$.
|
|
|
|
|
Hi Professionals,
We have a complex application developed in asp.net web forms and ajax. the Application is very heavy and contains many complex functions. Lengthy (Header/details) forms, Complicated Gridviews and all supported with ajax controls.
the application has been enhanced for the last 10 years to keep it with the latest tehnology and trends.
we are planning to do major enhancement to the application - converting it to HTML5 and jquery/bootstrap
the developers advising to re-develop the application in MVC because it is fully support jquery/callback and bootstrap
I am not sure if we can go to in this direction or not. the current application is event based. most of the events are handled in the server side. for example we have a form with many sections being displayed or hidden based on a selection from multiple dropdowns. for that we are using asp.net panel with visible property.
and we have other screens with gridviews loading huge data (more than 50,0000 rows) and we used the gridview built-in paging and sorting. beside we also have nested grids (Expand/Collapse) for each row of the parent grid
I am not sure if all of these functionalities can be achieved by MVC/Bootstrap.
could you please, advise.
Hussain Mohammed Saleh Attiya
ISP Technical Manager
Atyaf Telcom - Bahrain
|
|
|
|
|
There is literally nothing the can be done in WebForms that MVC cannot do. Your team will just need to be prepared to work more in JavaScript.
The underlying technologies are still exactly the same, the separation of concerns is just more clearly drawn.
It will take time, though.
"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli
|
|
|
|
|
Nathan Minier wrote: Your team will just need to be prepared to work more in JavaScript.
Why?
|
|
|
|
|
Because that's how event driven controls in are managed on a client system, and MVC does not provide a shake-and-bake ajax-supported event-driven control model.
I mean, is that a trick question?
"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli
|
|
|
|
|
Nathan Minier wrote: MVC does not provide a shake-and-bake ajax-supported event-driven control model.
MVC does provide all of that, and these are possible, only fact is that we don't use this anymore.
Download the boilerplate template, it contains most of Angular, Bootstrap. What are they? 
The sh*t I complain about
It's like there ain't a cloud in the sky and it's raining out - Eminem
~! Firewall !~
|
|
|
|
|
Afzaal Ahmad Zeeshan wrote: Download the boilerplate template, it contains most of Angular, Bootstrap. What are they? 
They're JavaScript and CSS, not MVC.NET. That's kind of the point: you have a proper separation of concerns between the server and client processes.
"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli
|
|
|
|
|
WebForms supports jQuery, bootstrap etc too. Both webforms and MVC are server-side technologies and contrary to popular belief you don't need javascript to use either of them, and similarly using them does not mean you can't use javascript technologies either.
However you can't really "convert" such an app as you have from a server-side methodology to a client-side one. I think you can maybe re-engineer some things such as, for example, ditching datagrid paging and instead use jQuery to call web methods to return the data as pages and then update the DOM directly. These things are no less possible in webforms than MVC.
The way I see it you can only add these types of enhancements and introduce these techniques a bit at a time, or you can commit to full rewrite the app and take the opportunity to improve it in many areas as I'm sure the app would benefit from this. If you do commit to do that then moving to MVC at the same time would be a good thing to do, but it will involve a complete re-write and there will be a steep learning curve for your team.
However don't think you have to use a certain server-side technology to use a certain javascript framework, as it's all just html.
|
|
|
|
|
The main difference between ASP.NET Forms and MVC (except the strict separation of concerns), is where is your code-behind, if any...
The main concerns you have to look for:
1. Time - MVC is not RAD!!!
2. Separation. While in ASP.NET Forms you could bend the rules and mix layers MVC will break under same conditions, and for that the design/develop cycle must be more precise and time consuming...
3. Knowledge of client side technologies... MVC gives you grate control over the final output of rendering, but it can be a burden as you HAVE TO take care for almost every details for your own...
4. OO? Not really. MVC views can not inherit the same way web forms do, so all the idea of master pages and inheritance must be redesigned...
To make it clear - there is no actually anything will stop you from porting your application, but it will be a big challenge and you and your team will have to learn a lot of new things and ways of doing them...
On a personal note: We are in the middle of a similar process. We are merging an ASP.NET Forms and a Win Forms application into a new - modern web application. We are talking about thousands of pages in the final project...
Our final solution is to write our own framework, that enables developing the same way we used to do with Web Forms, but translates old style code to MVC like... So we actually mixing ASP.NET Forms and MVC in a way that still enables RAD development with full OO, but take advantages of the MVC (modern) based development...
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
I'm currently porting my web forms app to MVC at the moment. Started last Jan 20, 2016 and plan to deploy it next Mar 2017. My web app was written in VB, so I had to convert to c# as well.
Best call or decision I ever made. I can't wait to deploy the new app and run it. I thought about all the cool stuff I had already had ending up throwing in the trash and writing even better stuff to replace it.
So now I have the whole setup, EF6, automatic migrations, node.js, bower, gulp, bootstrap, fontawesome; with automatic css, js, image compression on every build, and package updates. I can validate a form off a model or just in JQuery. I save 3 hours now every time I publish a change.
It took me 6 months to really learn all of the above, but now I'm jamming fast creating very functional single page apps and so forth with very reusable code. Once you past the learn curve, your reusable code propels you forward at a very fast rate. I's say I'm 8X faster now than Web Forms.
Those complex headers your asking about, you can write an Attribute "OnActionExecuting" class, that will do your header work, and add the name to the top of the controller Action to run it every time that action is called. I have a bunch of these now, one I use for shopping and checkout for security and to replace the Identity module.
Ajax work is a breeze; for I have an Ajax controller that does nothing but ajax calls, returning a JsonResult; just pure json back.
I don't know about the gridview, but suppose you can write something from scratch, it's just HTML. But HTML5 and Bootstrap has stuff that can replace it.
IMO; wish I would of made the move years ago.
Go for it!
Globalism is Socialism on a planetary scale.
|
|
|
|
|
jkirkerx wrote: My web app was written in VB, so I had to convert to c# as well.
I'm not sure you had to convert it - it's possible to write MVC using VB.NET:
Getting Started with ASP.NET MVC 5 using Visual Basic[^]
But it was probably a good move anyway. Most of the samples you find tend to be in C#, and you'll have fewer people mocking your choice of language. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
More like translate it.
I'm no writing any more VB programs in the future.
much easier to write c# now and faster, less typing.
Thanks Richard!
Oh project is coming along sweet now. Been awhile since I asked for help with MVC, getting much better at it and the whole. Just love this stuff!
Globalism is Socialism on a planetary scale.
|
|
|
|
|
Thanks for everybody. After we viewed your replies. we are still evaluating
Hussain Mohammed Saleh Attiya
Sr. System Analyst
Gulf air - Bahrain
|
|
|
|
|
Hi,
I am part of a MVC Web application that contains a Web API. Unfortunately, as I am new to MVC, could the experts out there help me how to integrate the WebAPI into my MVC please?
Thanks
|
|
|
|
|
Check here if you want to call the API server-side (e.g. from within an MVC controller). If you want to consume it on the client side, you could use AJAX or similar with the API URL.
djj55: Nice but may have a permission problem
Pete O'Hanlon: He has my permission to run it.
|
|
|
|
|
sunsher wrote: help me how to integrate the WebAPI into my MVC please?
Do you want to access Web API or access it in MVC?
The latter is as simple as calling functions on your API object, former one requires a bit of setups, such as routing configurations etc. Be more specific so we may help you.
The sh*t I complain about
It's like there ain't a cloud in the sky and it's raining out - Eminem
~! Firewall !~
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
