Security :: Finding Replacement Options For Membership?
Aug 18, 2010Finding Replacement options for Membership?
View 5 RepliesFinding Replacement options for Membership?
View 5 RepliesI need to know is there any way to separate the classes automatically created by Entity framework. I can not use POCO template. because I have restriction to use framework 4.0 for time being.
I am having VS 2008 Framework 3.5
Do I have any service packs which gives me POCO.
I have this small piece of code
var idObjects = Spring.Context.Support.ContextRegistry.GetContext()
.GetObjectsOfType(typeof (ICustomInterfaceThatDoesSomething));
foreach (ICustomInterfaceThatDoesSomething icitds in idObjects.Values)
icitds.DoSomething();
Is there a way i can avoid this by having spring.net automatically inject the singletons to a property i declare, like an array of ICustomInterfaceThatDoesSomething?
The only reason i want something like this is because i want to kill the .dll dependency on the project and this is the single point of usage.
What is the best replacement for ServerXMLHTTP30 in .NET 3.5. Is HttpWebRequest good candidate?
I am in the process of creating an application that will get a XML stream as a response to a request.
Without reading the whole text below, since this is on the ASP.Net side ... basically I think I need to know if there is a way to reduce the size of the forms authentication cookie. When using a DotNet 2.0 website, the ASPXAUTH cookie is about 232 bytes ... when using the same source code but upgraded to DotNet 4.0. the cookie is approximately 264 bytes, setting the ticketCompatabilityMode does not reduce the size since I think the default setting is Framework20. I length of the cookie, including the its' name can not be larger than 256 bytes in order to use it with the "Client Application Services".
I only did a cursory search of the asp.net forums, but will dilligently look for an existing solution.
----- BACKGROUND AND RESEARCH -----
I have been using all three features of client application services (authentication, profiles, and roles) in my windows app (DotNet 3.5 framework) for almost two years now. Up until now, I have not had any problems. This week I hit a brick wall and am pretty stumped with two seperate but related issues.
Issues:
In development, we decided to upgrade our websites/services to DotNet 4.0. All applications upgraded successfully. However we are unable to log into our application using Client Application services. No matter what user we use, Membership.ValidateUser returns false. Since we know the username and passwords, we thought this was strange. When debugging the application, we found that Membership.ValidateUser was throwing an InvalidOperationException (see below for complete exception) stating that the ASPXAUTH property was too long, longer that the schema created in the SQL/CE database. (See below for things tried).
In production .. A user all of the sudden could no longer gain access to the application. Upon inspection, his ASPXAUTH cookie was 264 characters long (9 characters longer than the schemas nvarchar(256)). Even though the user was being authenticated on the "server side", and the JSON query returned "{"d":true}", Membership.ValidateUser returned false. Again, as in the case above, the actual error was ...
Message=@PropValue : String truncation: max=256, len=264 ...
I am assuming I am missing something very simple or that I overlooked a settings. In development, this is not a huge issue as I can release the Dotnet 4.0 websites when I am ready. But now that this has happened to a client on a production system, it is very worrisome.
[code]....
Various tutorials and articles describing the N-tier architecture use the "Open Late Close Early" methodology for Connection objects. The connection is just opened before a "ExecuteNonQuery or ExecuteReader" command, and closed immediately
This means that inside a transaction where a number of business objects have to be updated (using different DAL classes), the connection can be opened and closed many times.
In that case the transaction will be escalated to a distributed transaction. Now we can’t assume that MSDTC will be availableunning every where. Now if I am building a website to be uploaded using those shared web hosting services, which does not allow MSDTC , what are my options ?
I'm using FilteredTextBoxExtender (Ajax ControlToolkit) to avoid entering unwanted charecters.
its working according to my requirments But I want to display message when user trying to enter Invalied charecters.
Is there any such options in FilteredTextBoxExtender
I am having a strange authentication issue moving sites from IIS 6 to 7. I am still very new to IIS 7 and have not been able to find a reason for this. The site is running with form authentication and windows authentication enabled and anonymous disabled just as it was in IIS 6. I did not find any useful posts here or on the IIS site, so I am hoping someone might know the answer to this.
View 1 RepliesI have a Default.aspx program that contains a Treeview with a SiteMapDataSource. I also have a web.sitemap loaded up with urls. When I run the deafult app I get the tree layout that matches the numbers of options but no text on any of the options to click.
View 1 RepliesWhy am I not able to login using my login control if I set the sql server database option for Recursive Triggers Enabled to "True"? Whenever I attempt to do so, I receive an error message on attempting to login that states "Your attempt to log in was not successful..."?
View 2 RepliesI really need some help here. I am brand new to using Visual Studio, but need to create a web page in which you must pay to register and view a Members Only page. I have followed a lot of instructions in these forums, but seem to have hit a wall.
First off, I am not able to use the ASP.NET Configuration under the Website tab. I have already created a New Web Site, selecting Visual C#, then the first option for ASP.NET Web Site. I chose File System for Web Location, etc. Long story short, I have made an ASP.NET Web Site with Basic User Login. The Login functionality is absolutely fine, I am able to view the site locally, register, and log in no problem. However, when I try to choose ASP.NET Configuration under the Website tab, nothing happens. From what I gather, I need to use the ASP.NET Configuration in order to configure membership permissions, and therefore
need to open this part of the program. In the long run, I would like to make it so that User Logins are sent via e-mail to people who have paid me and that wish to use my site, which brings me to my foreboding second problem.
I eventually need to find a web hosting service that will allow me to do all the things I have described. I was going to go with GoDaddy.com, but after doing a bit of research I realized it may not be the best option for what I am trying to do. However, through research, I have realized that VS 2010 is the best program to use for what I'm doing, but I'm in a bind because of inexperience, thus writing this question in this forum.
Any help making this web site would be greatly appreciated, I am definitely in way over my head. I have worked with computers for the last 10 years, so my inexperience is mainly with ASP programming.
Just to let you know, I have VS 2010, Visual SourceSafe, and SQL Server Express installed on this fully capable machine. What I am really looking for is someone to guide me through the process of creating this website, either through pointing me in the right direction or explaining in detail all the next steps that I must take.
I'm working on a website where it should be possible for registered users to upload word documents. The administration of users is done through Membership and Profiles. When the documents have been uploaded, the following needs to be achieved:Non-registered users should not be allowed to download documents I should be able to control which users that has access to which documents I should be able to register which user downloads which documents I should be able to track how many times a document has been downloaded
Can this be achieved be using Membership and Profiles?
I'm trying to use the Membership.CreateUser method without passing a security question and answer. I set them to string.empty, but no go. I have my provider set to not require a question in my web.config. What am I doing wrong?
[Code]....
This is my first membership provider; I converted the sample provider [URL] to SQL. I created a vb class provider and put it into the App_Code folder. After it was created I tried to modify my webconfig but the error pops up. I don't know what else to try, I don't know if I have missed something
webconfig:
[code]....
I have started to implement asp membership. I go the administration page and click provider. I have a database on a server on the local network that i want to install my members tables in. When i run the
aspnet_regsq.exe it doesn't ask me what SQL database i want to use and seems to default to my local SQL Server 2005 installation. How I change this to use my SQL Express database on a local server?
I have to implement a small webshop. Basically it's just a website with a huge backend ERP System and with the possibility to sell one (yap, really only one!) product on the website. The only requirement is a MySQL Server. The backend is almost finished (about 95%) and is secured with the .net MemberShip Provider for MySQL (the one in MySql.Web from the MySql Connector .NET).
Now to my question: I can set up the membership system easily but I do not need such things like username or password-question but I would need a reference to an address table to store the users home address. So, it is possible to change or customize the membership system to for eg. a unique customer id instead of the username column and set this in codebehind when the user is creating a new account? And is it possible to insert new users/customers from codebehind in an easy way? (I mean without checking each foreign key and inserting the customer reference to the userinrole table and so on...)
I am building a site and I want to use the default membership controls provided with asp.net like Login View Control etc. I don't want to use the ASP.Net Membership DB as I want to use my own Security structure and I don't want to inherit the ASP.Net membership class either. In my case how can I use these controls to aid me like how will a login view control detect if someone is authenticated or not.
View 7 RepliesI've set up a system with forms based authentication and using the asp:Login control. When I put in an invalid password I get the approriate invalid password message. However when I put in a valid password, it does nothing...just returns to the login page again. I'm triple checked the login info. There is no error message, and the invalid attempts counter doesn't increment. When I put a break point in the Login_LoggedIn event of the Login form, it hits it, but User.Identity.IsAuthenticated is false. I'm not 100% sure it should be true at this point, as I'm pretty new to .NET but it seems kind of odd.
My user database is stored in a sqlserver 2005 db that already existed. I've added a new connection for it.In the authorization I have
<authorization>deny
users="?"/><authorization>
I created a soultion and used membership for login and I have the site working fine you can log in and out and I can see that my roles are working. I created a folder called Admin and I created a webpage in there that I can edit my data table that I wanted to be able to edit when I am logged in as a user with Admin role thats working... well it works...
anyone can get to this webpage and edit my data. I have it set in the membership using the role managment to deny users * and allow users with Admin role however I can open up a new browser with out login into my site and type in the web information and it pops right up says Welcome:Guest [LOGIN] theres my data and I can edit it see do whatever and this page shouldn't be able to be seen.
What did I do wrong?
example www.domainname.com/admin/editmydata.aspx
am working on an asp.net application with membership controls and the SQL Server database. I have this put together, however it appears that adjustments need to be made to enhance security. Many websites have membership features, so I was wondering if there are some blog posts that describe the steps that need to be made to enhance security.
View 3 RepliesIs URL Routing is replacement for URL rewriting.? Or each of them have their own pros on cons?
View 7 RepliesIf my understanding is correct, it is not possible to use the Datapager with the Accordion control. So, I am trying to find a way to replicate the functionality and wonder if anyone can recommend a method of doing it.
I am after a control/strategy that is 'pageable' where I can have a 'header' with general item information and with some means of displaying more detailed information, if required, without having to leave the current page.
Are there any resources for drop-in replacements for the default css that comes with the ASP.NET Website template? (.NET 4.0)
View 1 RepliesI do need a working ASP.NET C# code to replace characters in a string.
My following code works fine but in case of input "a" it gives me an output as "678d", but in case of input "c" the output is correct as it is i.e. "8d"... Here it automatically replaces the rest values too. I can see the code is executing in a step by step process... This results me to get an overloaded output.
{
StringBuilder builder = new StringBuilder();
builder.Replace("a", "6b");
builder.Replace("b", "7c");
builder.Replace("c", "8d");
return builder.ToString();
}
Now, I do need to replace "a" as just "6b" and it should not load the rest values.
I have a page that will receive an encrypted query string containing a user name, password & jobId, the problem is I don't want someone to be able to grab the encrypted url (browser history) and reuse it, so it has to change each time the page is requested.
The only way I can think of doing this is by having an encryption key associated with the the job and then change it after each time the page is requested. The client would either request the key or the entire url from a web service residing on my server.
Is this the best way to do this?
Is there a mutating encryption method out there I could use "out the box"?