ASP.NET

What url option does with ajax begin form

14-Jan-18 22:09

No because iframes exist on the client, they are only accessible via code that runs on the client such as javascript. The code on your vb files runs on the server and has no knowledge of, or access to client iframes.

Mou_kol8-Jan-18 22:00

Re: What url option does with ajax begin form

8-Jan-18 22:00

i am talking about asp.net mvc.

just seen a example but do not understand when people mention url with ajax begin form?

@using (Ajax.BeginForm(new AjaxOptions { Url = Url.Action("Foo", "Bar", null, "http") }))
{
    ...
}

when we need to post data to different controller and action then url is used?

if yes but ajax begin form has option where we can specify controller and action name then why should we generate url where form will be posted ?

The Ajax.BeginForm takes the following parameters

actionName
    controllerName
    routeValues
    ajaxOptions
    htmlAttributes

please help me to understand the url usage with ajax begin form. thanks

Vincent Maverick Durano9-Jan-18 19:20

Vincent Maverick Durano

9-Jan-18 19:20

The URL option is used to to set a specific url to POST something to it. The URL option is there so you could specify a full string URL and not just an ASP.NET MVC Controller/Action format thing. So typically in ASP.NET MVC, you could just do:

HTML

@using (Ajax.BeginForm("YourAction", "YourController")

to POST to an MVC action. To POST to a URL specific route, you could do:

HTML

@using (Ajax.BeginForm(new AjaxOptions { 
    Url = "http://www.somedomain.com/foo"
}

Best way to prevent xss attack

Mou_kol8-Jan-18 0:23

Re: Best way to prevent xss attack

8-Jan-18 0:23

i have editor which external user will use to create page. now wicked person can inject something malicious. so tell me how to prevent it?

i will allow user to upload any string data but how could i show it in page as a result html will display nicely but if there js code that will not be executed....just display html.

how to exclude script section from html data when displaying in page. thanks

Richard Deeming8-Jan-18 6:25

Richard Deeming

8-Jan-18 6:25

Use something like AngleSharp[^] to parse the content, and strip out any tags or attributes that aren't explicitly allowed.

You'll probably also want to set up a Content Security Policy[^] to block inline scripts and third-party scripts that your site doesn't use.
NB: Some older browsers don't support CSP, so you can't solely rely on this to block XSS.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Re: Best way to prevent xss attack

Mou_kol8-Jan-18 21:04

Re: Best way to prevent xss attack

8-Jan-18 21:04

i read article from these links
http://www.dotnet-programming.com/post/2015/04/12/How-to-Handle-Cross-Site-Scripting-in-ASPNET-MVC-Application.aspx
https://www.codeguru.com/csharp/.net/net_asp/preventing-cross-site-scripting-attacks-in-asp.net-mvc-4.htm

they saying to use AntiXSS library. can i use in production? is it robus?

guide me. thanks

Richard Deeming9-Jan-18 1:21

Richard Deeming

9-Jan-18 1:21

The AntiXSS library is robust and perfectly suitable for use in production.

However, that will completely encode the output. From your original post, it doesn't sound like that's what you're trying to do.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Angular 4 having vs2013

soumyaraj7-Jan-18 18:54

soumyaraj

7-Jan-18 18:54

Please let me know the step which is created for an MVC project with angular 4 in vs 2013 or give any reference link

Re: Angular 4 having vs2013

debasish mishra8-Jan-18 23:23

debasish mishra

8-Jan-18 23:23

Integrating the Angular 4 CLI With Visual Studio Professional & Visual Studio Code[^]

Guidance required to show date and time as per user's timezone wise

Mou_kol6-Jan-18 6:16

Re: Guidance required to show date and time as per user's timezone wise

6-Jan-18 6:16

suppose i have a interface from where user insert data to database. database is running in USA pc. user may enter data from USA,UK,Germany and India. so their timezone is different.

so do i need to store date and time as utc format ?

how to send timezone info of user to sql server store procedure and in sql server store procedure convert utc date and time to supplied timezone?

how to capture user timezone id or name which i will use to convert utc date and time to specific user time timezone info ?

i need to develop a application which show data entered by user from different country and data will be stored in USA pc.

please guide me detail.

Richard MacCutchan7-Jan-18 2:43

Richard MacCutchan

7-Jan-18 2:43

Never save timezone information when saving datetime information. Always store dates and times as UTC values. The timezone information is only needed at the user's PC, when converting between local time and UTC.

Re: Guidance required to show date and time as per user's timezone wise

Mou_kol7-Jan-18 4:48

Re: Guidance required to show date and time as per user's timezone wise

7-Jan-18 4:48

at client side how could i convert utcdatetime to local datetime? give me some link or hints.

Richard MacCutchan7-Jan-18 6:09

Richard MacCutchan

7-Jan-18 6:09

convert utc datetime to local datetime javascript - Google Search[^]

how to prevent csrf attack by using csrf-token

nooshiiin5-Jan-18 18:58

nooshiiin

5-Jan-18 18:58

hi please give me a code i want to prevent my website from csrf by using csrf-token, i want not to show page url or generate a random code in my url that expires every new time that we click on the link how can i do it?

Re: how to prevent csrf attack by using csrf-token

debasish mishra8-Jan-18 2:16

debasish mishra

8-Jan-18 2:16

There are great number of examples available in Google for CSRF-token.Language obviously you can only know whether you are using java or C#.Net or whatever.Please be specific while you are discussing on some topics.

Browser cookie and session cookie

Mou_kol5-Jan-18 0:12

5-Jan-18 0:12

We know when a user request a website first time then a session cookie dropped in user pc. If browser cookie is disabled then how session cookie is dropped at client side?

if browser cookie is disabled then session cookie is append at the end of url as query string?
please tell me what happen for session cookie when browser cookie is disabled in asp.net MVC.

F-ES Sitecore5-Jan-18 0:45

5-Jan-18 0:45

If cookies are refused then the user gets a new session with each request, the site doesn't know it is a returning user. You can configure cookieless sessions in the config which will add a tracking ID to the url instead but this is generally a bad thing.

Mou_kol6-Jan-18 6:12

6-Jan-18 6:12

sorry not clear. you said - If cookies are refused then the user gets a new session with each request

if browser cookie is disabled then session id will be append with url like cookie less session ?

if we configure cookie less session then session id is added with url. so if browser cookie is disabled then session id will be added with url?

thanks

F-ES Sitecore6-Jan-18 6:14

6-Jan-18 6:14

If you want cookieless sessions you need to enable them in the configuration and everyone uses them, even people who accept cookies. Generally I'd stick with cookies being required for sessions, if the user doesn't want to accept cookies then they have to put up with the consequences of that.

Mou_kol6-Jan-18 7:02

6-Jan-18 7:02

just tell me if browser cookie is disabled then session id will be passing to client?

F-ES Sitecore6-Jan-18 7:07

6-Jan-18 7:07

Yes it will but it will just be thrown away by the browser.

Mou_kol7-Jan-18 1:16

7-Jan-18 1:16

you said -- Yes it will but it will just be thrown away by the browser.

when session id will be thrown away by the browser then error screen will be displayed?

F-ES Sitecore7-Jan-18 2:11