Security :: Secure Images From Being Easily Access?
Feb 8, 2010
I have read that the best way to secure images from being access would be to place them into a database rather than into a file system or virtual directory. Is this correct? I am creating a site that needs to have the images the user upload be secure as possible. I initially programmed the images to be uploaded to a database then I reprogram the site to have them store in to a file system/virtual directory. I'm still up in the air in terms of which one to use. Again, security is my primary concern.
View 4 Replies
Similar Messages:
Mar 3, 2010
provide secure online access to documents and reports for their customers which entails creating a secure login for clients to access PDF documents to view and print. Aslo to display all reports available on web server.ould this be as simple as making sure username & password match an entry in a username table using select parameters(of course) theninstituting a Session("loginokay") = True along with something like Session.Timeout = ?
View 5 Replies
Oct 24, 2010
I have a custom mini login user control that I have embedded in the top of my website which shows on every page. These pages are non-secure HTTP://. I would like to avoid having to redirect the user to a HTTPS page to perform the login but I definitely don't want to send login credentials to the server in plain text.
I am trying find a method to send the user's login credentials encrypted via https from a non-secure (http) page.
I tried to set the postbackurl for the login button to itself but in https, but the user's input is not retained and the buttonLogin_click is not fired when I set the button postbackurl property. My ASP.net web application is VB.Net framework 4.0
I am assuming this can be done because I see lots of websites where login fields are on available on every page and they are running http and I can believe they are not encrypting the login credentials.
View 3 Replies
May 31, 2010
I work with a ASP.NET UI framework that pulls fields for a particular screen off a database. These fields can be associated with particular data fields in another database for binding. The idea with this setup is that if a client needs a new column on a table, they can easily add it, and create a UI field that binds to it without any sort of application restart or recompile.
The problem I've always had with this is that it has meant I'm always having to work with untyped datasets in my code. Are there any ORM libraries for .NET out there that could easily accommodate the requirement of being able to access arbitrary columns in the table schema over and above ones mapped to strongly typed fields?
View 1 Replies
Mar 20, 2010
I want to read some information from an xml file and store it ready in memory so that it can go out with every page response without being reloaded from the xml on every request.
What is the best way of doing this?
It looks to me like there are 2 options. Either create a class with static fields that the information is stored in. Or create a class with public fields that the info is stored in and create an instance of that class at application level.
Is that correct, are both of those options viable? or will I not be able to access the fields in the second method without creating an instance of the class in the code that responds to the page request(basically if you create an instance of a class at application level can you use that instance from within code anywhere in your website as long as it is public)?
View 8 Replies
Nov 11, 2010
i have an image (say abc.gif) that i would like to allow the user to "view" only if he is logged in to my system. Currently i am checking whether he is logged on to my system using session variables.
View 5 Replies
Feb 11, 2010
I'm using profiles to save control settings of users.
I have a check box that enables them to 'enable' saving their settings.
rather than cycling through each parameter, and setting them to Null,
is there a way I can do something like:
Profile.Something = Null
[URL]
View 2 Replies
Jun 18, 2010
At first I got an error that the user did not have permission to read the config file (web.config).
So I gave NETWORK SERVICE and IIS_IUSRS read on the website folders.
But now vistors can not access images and other static content from the Content folder without logging in. Aspx and .ashx content works however static content is redirected to the login page.
View 6 Replies
Nov 9, 2010
I only want my web images to be visibleSimpliied, a digital media page pulls html content from a database using SQL security and renders that HTML. That digital media page is secured in that only a returing Paypal transaction user with a matching transaction can access it. But today that HTML content makes references to images on my site, those images can be freely directly over the web.The backend is asp.net 2.0. Would it be possible for me to secure the web folder with my images to some generic user and impersonate access from my pages so that attempts to access images directly fails?f not, any way to solve all that html content on serverside somehow and turn it into something else I can secure?
View 1 Replies
May 14, 2010
If I have users upload images to my web server, and they are simply stored in a folder, how secure are they? This of course is assuming that IIS is configured not to serve image files directly from a browser request, or mods are made in the web.config file to prevent direct access, etc, ex:[URL]
View 5 Replies
Feb 1, 2010
I'm using a masterpage on my website and the images appear correctly on all pages except the secure pages. The login page is formatted correctly, its just the page that is held in the secure folder. Both the header and footer images are either not appearing or are formatted incorrectly.
Code from the masterpage is below:
[Code]....
View 3 Replies
Sep 6, 2010
I am learning to use asp.net to design a web site and i am not quite sure if the way i access the data base is appropriate. could you guys give me some comments ?
----------------------------------------
in web.config , i have a connection string like this,
<add name="MyDBConn"
View 3 Replies
Apr 6, 2010
We have a swf file that we want to secure and make available only to authorized users.
I embedded the file in an aspx page and that works fine, since ASP.NET handles the aspx page, I can use ASP.NET authorization features and in the web.config restrict the access to roles="AllowedUsers" for example.
However smart users could still get to the file by accessing directly for example www.mysite/flash.swf. We want to make that kind of access secure.
View 2 Replies
Jun 7, 2010
i am creating a web app for a small buisness enterprise in which i have added a node in my menu (stocks) accessible to limited users
every time a user try to access this node , it will ask for his/her credentials. iam using asp.net login control( in built ) for this . Also i used
<authentiaction mode='forms' />
<authorization>
<deny users='?'>
</authorization>
for these pagesin my web.config file now apart from that , how can i made it more secure using asp.net membership provider.
View 2 Replies
Jan 25, 2010
I have an MVC app that uses [Authorize] to protect the private bits. When I select the SignOut() URL it signs me out but if I hit the back button on my browser the it goes to the secure page and even lets me use the form. The action takes place and then it shows that I'm signed out. The problem is that it performs the secured action (inserting a row into my database). Then I can use the back button again and do it all over. If I use the back button after logging out and hit the browser refresh it does show I'm logged out and refuses me access to the secure page. Am I missing something important? It seems like it could be a really big security issue.
public ActionResult LogOff(string ReturnUrl)
{
FormsAuth.SignOut();
if (!String.IsNullOrEmpty(ReturnUrl))
{
return Redirect(ReturnUrl);
}
else
{
return RedirectToAction("Index", "Page");
}
}
View 3 Replies
Feb 15, 2010
We need to secure how our web application access our SQL 2008 database on our hosted server. Any pointers where this is covered in detail? We have the following questions:1. right now the network service account runs the application pool containing our application in IIS. Should we define a local windows user account to run this application in IIS 6? Should we switch to Windows authentication?
View 3 Replies
Jan 6, 2011
I have 4 file uploader in my form to upload 4 images in the DB for each article submitted. My issue when I want update/edit my article with some new pictures and I want delete or update the old pictures with the replacement with the new one.
How I can implement it? I am using ASP.NET based on VB.NOT .... NOT C#
View 1 Replies
Jan 13, 2011
I'm creating a ASP.NET/SQL Server 2005 Express app which requires users to upload supporting attachment or documents in .docx and .pdf format. The web server is IIS 6/Win 2003. I'm trying to come up with a good way of securing these documents so anonynous users cannot see them and creating a separate Windows login for every user is not an option. SQL Server Express does not have blob data types. I'm storing each user's authentication information in the SQL database and not really using forms authentication.
View 1 Replies
Apr 9, 2010
I would like to send email securely to third party with attachments containing sensitive info. The website is configured with SSL. I'd like to know how to send email securely via asp.net app.
View 3 Replies
Jan 24, 2010
i have asp.net 2.0 web site and in the main root i have some secure pages so if any unauthenticated user try to visit my page the browser redirect him to login.asp page (it was correct) but in my web i have subfolder named (Admin) and i want to secure all pages under this folder and redirect any user to new login page. how can i do it?
View 7 Replies
Apr 30, 2010
I've got IIS 6 with a self-signed certificate installed. This is now securing the whole site (all urs are HTTPS). How do I only apply HTTPS to logged in areas, leaving publicly viewable data with HTTP?
View 8 Replies
Apr 22, 2010
I'm auto-generating a form in my ASP.NET page. This is already tested and working. I want to know if:If there are any security problems with storing the database ID as part of my controls ID? I can see think of 2 issues: the id will be visible in page source (not really important in this case), and the possibility someone could change the name of the control somehow? This second possibility is more serious. Is this a potential problem and how to void it?If there would be a better preferred way to associate a unique data with any type of control? Is it possible to store a custom item in the viewstate for the control?
View 5 Replies
Mar 11, 2010
I'm building a forgot password feature for my first secure backend.
I want to email a url containing an encrypted parameter to the user which will lead them to a password reset form that can only be accessed via the url with the encrypted parameter.
But what if the email gets intercepted?? then anyone who intercepts it will have the link to the reset page.
Is there a way I can send a secure email? I know nothing about email really. Is it even possible to send a secure email? Can I encrypt the email, will that help? But if it is encrypted then how does the recipient read it?
View 4 Replies
Jul 4, 2010
From what i know Random() is initialize to the current time. If two connections hit during the same second i should get the same two random numbers? With a large site that can be likely. Locking is bad so how should i solve it? note: the number is used for the session id.
-edit- i am stuck using a long. It feels wrong to shorten a 128bit GUID
View 2 Replies
Mar 1, 2010
In my environment, we use Active Directory as our password repository. I'm writing an app that uses the users windows session (windows auth) to authenticate the user. This is working well, but I need to provide a way for users to log in as a different user. I setup a web form to accept a username and password. My question is this, I need a secure way to validate the user's credentials against AD. I cant have the credentials passed as clear text. Ive come across the impersonate user functions, but i'm leary because you have to pass a clear text password into the password field. I know I could also use LDAP, but without a certificate, I know plain LDAP is relatively insecure. Can someone point me in the right direction of a more secure solution to query AD with the credentials?
View 3 Replies
