When a user presses Button1 on the Webpage, I would like to copy slightly modified string from txt1 (Text) into txt2 (Text).
The problem is sometimes I get an error "a potentially dangerous request.form value was detected from the client validaterequest". I get this error when special symbols llike "<" or ">" are in txt1.Text.I've read about that problem. That error is to prevent from hackers who can input scripts into the txt1.All I did is:
1) Put validateRequest="false" into <%@ Page Language="VB" validateRequest="false" at Default.aspx.
Now it works and allows to take any data from txt1, slightly modify it and put into txt2.So, my question is: Did a level of security was reduced after I wrote validateRequest="false" ? Any code should be added to keep the good level of security? Or, I'd better use another way to copy txt1 to txt2?
This involves using the Membership provider to add a comment to users server side records when they log in and out, and then confirming that when a cookie is used to authenticate, that the user hasn't logged out. This makes perfect sense to me. Where this starts to fall apart is that we do not currently use a membership provider, and so it seems like I face reimplementing all our authentication code to use a membership provider. We currently check authentication in a controller, and make a call to FormsAuthentication.SetAuthCookie() once we know the user exists. It would be a lot of work to force a membership provider in.
Is all this work really neccesary. Can I roll my own key value store of cookie values to logged in users and just make sure I clear this when a user hits the logout button. If this seems unsafe is there a way of implementing a minimal Membership provider in order to make these checks without handing off all authentication code to it?
I guess my main problem here is that we decided a long time ago that the membership provider model doesnt fit with the model we use for locking and unlocking accounts, and chose not to use it. Now we find that the MS recommendations specifically mention a membership provider, and as this is security I need to be sure that not using it as they recommend isn't going to cause troubles.
We have a flash site which uses POST requests to commumicate with the database, via .NET pages. There is no login, it's an open system. Since we are communicating with POST data we are using Request.Form to get the data posted from the flash. My issue is that anyone who can view that post request, in firebug for example, can then set up a post request from another server and this is not good as some of the actions are sending emails etc. Is there any standard way of preventing a POST request from another server when using Flash > .NET combo?
Is there a way to disable request validation on an action without having to add the line <httpRuntime requestValidationMode="2.0"/> to Web.config? I'm currently posting XML to a controller action and get the "A potentially dangerous Request.Form value..." error. Is disabling request validation the only way to get the post to work, or is there some way I can intercept and encode the value that contains XML between the view and the controller action?
I have a GridView and I need update some data inserting HTML CODE; I would need this data been stored encoded and decoded on request.
I cannot in any way disable globally "Request Validation" and not even at Page Level, so I would need a solution to disable "Request Validation" at Control Level.
At the moment I am using a script which should Html.Encode every value being update, butt seems that "Request Validation" start its job before event RowUpdating, so I get the Error "Page A potentially dangerous Request.Form ... ".
When I fire a get request to a view in my application for some reason my model validation messages are displaying immediately on the page even before a form submit.
I read that I need to turn the validation to version of 2.0 to make the validateRequest="false" attribute working. Well, but how to allow requests containing html in 4.0? How can I keep the 4.0 validation scheme and allow such request to come in, say for particular web page?
I don't understand why I should lower the security of other requests like web services . So what's the 4.0 way of doing that, really?
I have always been able to turn off request validation on IIS and cassini when I need to post HTML from an HTML Editor. Problem is I can't seem to do so on IIS express. Have tried the following:
I created a little web service to minify JavaScript, and everything was nice, with all my tests passing. Then I noticed a bug: if I tried to minify alert('<script>');, it would throw a HttpRequestValidationException.
So that's easy enough to fix. I'll just add [AllowHtml] to my controller. But what would be a good way to unit test that this doesn't happen in the future?
The following was my first thought:
[TestMethod] public void Minify_DoesntChokeOnHtml() { try { using (var controller = ServiceLocator.Current.GetInstance<MinifyController>()) { return controller.Minify("alert('<script></script>');"); } } catch (HttpRequestValidationException) { Assert.Fail("Request validation prevented HTML from existing inside the JavaScript."); } }
However, this doesn't work since I am just getting a controller instance and running methods on it, instead of firing up the whole ASP.NET pipeline.
What would be a good unit test for this? Maybe reflector on the controller method to see if the [AllowHtml] attribute is present? That seems very structural, and unlikely to survive a refactoring; something functional might make more sense.
I have a form that I have been getting submissions that have punctuation and special characters that trigger the potentially dangerous Request.Form value error. I have been trying use the httpUtility.htmlencode and Server.htmlencode method to sanitize textboxes and textareas.All my tests do not fire because the built-in request validation of the 4.0 framework prevents the code-behind from executing to perform the sanitization. I have included the ValidateRequest in the page header but no matter what I set it too it still does the same thing.
Let's say a security tester uses a proxy, say Fiddler, and records an HTTPS request using the administrator's credentials-- on replay of the entire request (including session and auth cookies) the security tester is able to succesfully (re)record transactions. The claim is that this is a sign of a CSRF vulnerability.
What would a malicious user have to do to intercept the HTTPS request and replay it? It this a task for script kiddies, well funded military hacking teams or time-traveling-alien technology? Is it really so easy to record the SSL sessions of users and replay them before the tickets expire?
No code in the application currently does anything interesting on HTTP GET, so AFAIK, tricking the admin into clicking a link or loading a image with a malicious URL isn't an issue.
I would now like to check if my code is still open to SQL Injections after this work. I believe the code is now working as it should, but any blinding errors that you see i'd love to hear about too. My code is now looking like:
I'm looking for a way of tieing the two together, so that the client-side validation is performed before the call to the "check(this)" in the onclick event.
Edit: To be more clear, I need a way to inspect or trigger the client-side validation result of the textbox, when I click the unrelated button beside it.
Edit: I now have the button JS checking for $("form").validate().invalid, but not displaying the usual validation messages.
using a linqDataSource control... in the selecting event I have code like the following for a simple search feature:
[Code]....
In general, would dynamically building the 'Where' property of a linqDataSource be vulnerable to sql injection? Or does the control protect against this internally?
where does following HTTP error message come from:
Due to the presence of characters known to be used in Cross Site Scripting attacks, access is forbidden. This web site does not allow Urls which might include embedded HTML tags.
We're using dynamically generated URLs and in this specific case the URL contains the characters '<' or '>'. We do URL encode the generated URL (so '%3C' appeary instead of '<') but it doesn't Our setup is ASP.NET MVC / IIS 7.5 / IE8. It's strange but it looks like the error appears only on some machines. So it could be that the IE internet zone settings are playing a role.
I have a ASP.NET XML web service (asmx) running on .NET 3.5. I am trying to figure out how best to prevent replay attacks. Is there any inherent security by .NET 3.5 that should mitigate this issue, or do I need some kind of SOAP header token value?
I am using microsoft visual web developer 2010 to build and publish my website, I am facing a security problem. My website has authentication service for my clients, each one he has his own user name and password. After I introduced a new member, my database collapsed, may be this last member is a hacker. Is their a way to improve security vulnerabilities to prevent future attacks. May be through web.config, could be encrypted.
I am using one datalist control for uploading multiple images.I hv used one Asp:FileUplaod Control and one button in one itemtemplate.I am using reqired field validator and regular expression validator for file upload cntrl I am assigning validation group for both of them on ItemDataBound event of my datalist so that each upload cntrl hv same validaton group as required field and regular expression validator.Now what i want to do is - i want to show my error message in validation summary which is right at the top of the page.I want one know how to write javascript that will assign validation group of my control in datalist on which i click ?
I'm using the "cache tecnique" to prevent multiple logins. Reading in this forum I have read the following code:
Global.asax
[Code]....
Login.aspx [Code]...This code works fine, If the user is already logged the second login is not permitted. But....
But if I make the logout (destroing all my session variables) and I try to login a second time... it's not possible, I read that the user is already logged!!I have also tried to clear the cache after the logout but nothing changs, even if it is illogic because the code must work even if I don't do the log off...
i have used ajax , but i am not very clear of its concepts
i just knw that it prevents full post back
1) frm where can i get a very clear concept for the use and purpose of ajax and how its to be used
2) i have a textbox with autocomplete extender and a button (button1)
button1 is in the updatepanel as i wanted tp prevent post back when i click button the datafrom the textbox is inserted in grid as the click event gave full post back i used updatepanel , now its wrking fine but the prblm is when i enter new datain textbox and fetech the deatils frm database full postback occurs i tried to put the autocomplete etext box in a update panel but its giving error.i need toprevent this post back
3) on the same button click at the end of the click process(ie after adding to grid)i need the autocomplete extetender text box shld be blank
there any way where i can make a page only accessible through a RedirectToAction? It's a bit dumb of a question given a redirect writes a URL.. I know it might sound a bit silly, but i really don't like the fact i have to be 'forced' to create a partial view to be able to make the page i want to redirect to. What i want to do is quite simply, after deleting a user account, redirecting to a page where it says, account deleted (with a bunch of other stuff), so its quite a simple task. I have no problem making a partial view here and there, but if i want to make many pages unaccessible, i think i would have to make most of the website in partial views haha. Maybe i'm getting it wrong though, i've read a couple of posts about it, including Phil Haack's ->http://haacked.com/archive/2009/11/18/aspnetmvc2-render-action.aspx But i'm still very confused about this subject,
How to prevent the new line character at the beginning of the text entering in a multiline text box? Now, I already trimmed the white space at the beginning of the text. but i can't prevent the new line character that has to be occurred by entering the enter key on the most beginning of the text box.
I am relatively new to ASP.NET and have searched the Internet to find guidance in preventing caching of web pages (in the latest versions of IE, Firefox, Chrome and Safari). Based on my search, I found a lot of conflicting/confusing info. As best as I can tell, it appears that I need to add the following 3 lines to the <head> section of my .aspx files:
[Code]....
if the aforementioned lines are correct and if all 3 lines are necessary? I have tried using different combinations of the 3 lines, but I get conflicting results (i.e., sometimes the page is cached and sometimes it's not).
I am developing a registration process which consists of 4 steps. Each step has its own action method. As such a user could type the url for each step as follows: bogusURL/Step1 //returns the View Step1 bogusURL/Step2 //returns the View Step2 etc... I would like to prevent users from gaining access to a step unless they have completed the previous steps. i.e. If they typed in bogusURL/Step2 without having completed Step 1 they should be redirected to the first step.
