Click here to Skip to main content
15,891,896 members
Home / Discussions / ASP.NET
   

ASP.NET

 
GeneralRe: Error Bind is not declared Pin
Member 1103130430-Nov-16 19:26
Member 1103130430-Nov-16 19:26 
GeneralRe: Error Bind is not declared Pin
ZurdoDev1-Dec-16 0:53
professionalZurdoDev1-Dec-16 0:53 
GeneralRe: Error Bind is not declared Pin
Richard Deeming29-Nov-16 4:29
mveRichard Deeming29-Nov-16 4:29 
GeneralRe: Error Bind is not declared Pin
Member 1103130429-Nov-16 20:35
Member 1103130429-Nov-16 20:35 
GeneralRe: Error Bind is not declared Pin
Richard Deeming30-Nov-16 2:12
mveRichard Deeming30-Nov-16 2:12 
QuestionHow OAuth is used to secure web api Pin
Tridip Bhattacharjee28-Nov-16 3:36
professionalTridip Bhattacharjee28-Nov-16 3:36 
AnswerRe: How OAuth is used to secure web api Pin
Richard MacCutchan28-Nov-16 6:38
mveRichard MacCutchan28-Nov-16 6:38 
QuestionHow HMAC authentication works for web api Pin
Tridip Bhattacharjee28-Nov-16 3:27
professionalTridip Bhattacharjee28-Nov-16 3:27 
just was reading a article on web API with HMAC authentication from this url http://www.piotrwalat.net/hmac-authentication-in-asp-net-web-api/

if possible some one briefly discuss what is HMAC authentication and How this type of authentication works for web api ?

what i understood from their article that client will have a secret key and when client will request web api service then they will send hash of secret key along with request and web service will compare the hash and if match then it allow to call action ?

if i understood correctly then i have some question. suppose if am sending hash of a secret key to web api then how web api know what key client have ? because if web api has to generate hash of secret key what client used for comparing at service end then web api has to know which client is sending data.

there is change of Replay attack for HMAC authentication for web api

the article raise some points which is not clear to me to prevent the chance of Replay attack for HMAC authentication for web api.

the points are

Imagine a malicious third party intercepts a valid (properly authenticated) HTTP request coming from a legitimate client
(eg. using a sniffer). Such a message can be stored and resent to our server at any time enabling attacker to repeat operations
performed previously by authenticated users. Please note that new messages still cannot be created as the attacker does not
know the secret nor has a way of retrieving it from intercepted data.

1) requests with different Date header values will have different signatures, thus attacker will not be able to modify the timestamp

we will generate hash based on secret key then how date comes to scene ? this points is not clear to me.

2) we introduce a requirement that no http request can be older than X (eg. 5) minutes - if for any reason the message is

delayed for more than that it will have to be resent with a refreshed timestamp.

point two is not clear. what this area try to mean delayed for more than that it will have to be resent with a refreshed timestamp.
tbhattacharjee

AnswerRe: How HMAC authentication works for web api Pin
Richard MacCutchan28-Nov-16 6:37
mveRichard MacCutchan28-Nov-16 6:37 
QuestionDifferent behavior firefox, chrome, safari Pin
equelna27-Nov-16 6:19
equelna27-Nov-16 6:19 
QuestionHelp please how to run dlls or activex controls on the intranet zone without pop-us without changing IE's intranet zone settings? Pin
lowracer24-Nov-16 21:34
professionallowracer24-Nov-16 21:34 
AnswerRe: Help please how to run dlls or activex controls on the intranet zone without pop-us without changing IE's intranet zone settings? Pin
Richard Deeming25-Nov-16 2:11
mveRichard Deeming25-Nov-16 2:11 
Questionblocking malicious bots (but not SEs) with web.config Pin
Scott5223-Nov-16 3:41
Scott5223-Nov-16 3:41 
AnswerRe: blocking malicious bots (but not SEs) with web.config Pin
jkirkerx23-Nov-16 7:25
professionaljkirkerx23-Nov-16 7:25 
GeneralRe: blocking malicious bots (but not SEs) with web.config Pin
Scott5223-Nov-16 7:29
Scott5223-Nov-16 7:29 
QuestionRe-Developing asp.net webform to MVC Pin
hussain.attiya18-Nov-16 6:21
hussain.attiya18-Nov-16 6:21 
AnswerRe: Re-Developing asp.net webform to MVC Pin
Nathan Minier18-Nov-16 8:31
professionalNathan Minier18-Nov-16 8:31 
GeneralRe: Re-Developing asp.net webform to MVC Pin
F-ES Sitecore20-Nov-16 22:28
professionalF-ES Sitecore20-Nov-16 22:28 
GeneralRe: Re-Developing asp.net webform to MVC Pin
Nathan Minier22-Nov-16 1:13
professionalNathan Minier22-Nov-16 1:13 
GeneralRe: Re-Developing asp.net webform to MVC Pin
Afzaal Ahmad Zeeshan24-Nov-16 2:24
professionalAfzaal Ahmad Zeeshan24-Nov-16 2:24 
GeneralRe: Re-Developing asp.net webform to MVC Pin
Nathan Minier26-Nov-16 2:20
professionalNathan Minier26-Nov-16 2:20 
AnswerRe: Re-Developing asp.net webform to MVC Pin
F-ES Sitecore20-Nov-16 22:37
professionalF-ES Sitecore20-Nov-16 22:37 
AnswerRe: Re-Developing asp.net webform to MVC Pin
Kornfeld Eliyahu Peter20-Nov-16 22:48
professionalKornfeld Eliyahu Peter20-Nov-16 22:48 
AnswerRe: Re-Developing asp.net webform to MVC Pin
jkirkerx23-Nov-16 7:56
professionaljkirkerx23-Nov-16 7:56 
GeneralRe: Re-Developing asp.net webform to MVC Pin
Richard Deeming23-Nov-16 12:11
mveRichard Deeming23-Nov-16 12:11 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.