C# - Cryptographic Licensing Module Not Working From Website?
Dec 2, 2010
We have developed a small method that pulls a cryptographic key from a signed xml document and then checks the signature using the SignedXml.CheckSignature method.
When run from a command line app the key validates properly. However as soon as I call it from a web app it stops working. Anybody know what could be happening?:
// Verify the signature of an XML file against an asymmetric
// algorithm and return the result.XmlDocument Doc, RSA Key
public static Boolean VerifyLicenceFile(string xmlLicFilePathArg)
{
bool isVerified = false;....
I we have created a website that requires users to login. It used forms based authentication and sql server to validation the login credentials.
Should we need to purchase an external connector license from microsoft to be able to host this site on a windows .net platform.
Edit: More information about external connectors. In microsoft licensing world there are cals for users connecting to the windows server software, external connectors are unlimited cal licenses.
Sometimes I need to block access on a website, but I don't want to block access for administrators so they should be able to see the website and for that I guess I need to make a module.
How can I make a module like that?
This is the code I have. I just don't know where I should place it.
For example when a user enters www.homeforhire.com they should be redirected to default.aspx (for operational reasons the user is then redirected to www.homeforhire.com/home.aspx).
Instead an error is caught in the Rewrite module (which should not be activated). I am using an http module to perform URL rewriting.
It appears as if the default document setup is not working correctly, and the requested page ~/ is being sent to the Rewrite module, causing an error (which is then caught by my error handler and the user is redirected to the home page).
Entering www.homeforhire.com/default.aspx works correctly.
Can anyone tell me why the default document settings in the web.config do not appear to be working?
We have an SharePoint site no login (anonymous) with a search module using AJAX. Now the users complains that the module isn't working. When I check the code (not developed by me), I find that the code only runs if "HttpContext.Current.User.Identity.IsAuthenticated=true". Could that ever return true on an anonymous site?
I have a custom code that I was planning to distribute as class dll. I would like to add Licensing logic to it so that my dll is not distributed freeely to others. In other words, I want to supply dll and licensing for each client. Is there a recommedation on how to do that?
I was thinking on hard coding some lookup value from client hardware and do such validation.. but not sure.
This question is somewhat of a follow up to How serious is this new ASP.NET security vulnerability and how can I workaround it? So if my question seems to be broken read over this question and its accepted solution first and then take that into the context of my question.Can someone explain why returning the same error page and same status code for custom errors matters? I find this to be immaterial especially if this is advocated as part of the work around to it.Isn't it just as easy for the script/application to execute this attack and not specifically care whether or not it gets a http status code and more on the outcome? Ie doing this 4000 times you get redirected to an error page where on 4001 you stay on the same page because it didn't invalidate the padding?
I see why adding the delay to the error page is somewhat relevant but doesn't this also just add another layer to fool the script into thinking the site is an invalid target?What could be done to prevent this if the script takes into account that since the site is asp.net it's running the AES encryption that it ignores the timing of error pages and watches the redirection or lack of redirection as the response vector? If a script does this will that mean there's NO WAY to stop it?Edit: I accept the timing attack reduction but the error page part is what really seems bogus. This attack vector puts their data into viewstate. There's only 2 cases. Pass. Fail.
Either Fail, they're on a page and the viewstate does not contain their data. No matter what you do here there is no way to remove the fail case because the page just will never contain their inserted data unless they successfully cracked the key. This is why I can't justify the custom errors usage having ANY EFFECT AT ALL.Or Pass, they're on a page and the viewstate contains their inserted data.Summary of this vulnerability
The cipher key from the WebResoure.axd / ScriptResource.axd is taken and the first guess of the validation key is used to generate a value of potential key with the ciphered text.This value is passed to the WebResource.axd / ScriptResource.axd at this point if the decryption key was guessed correctly their response will be accepted but since the data is garbage that it's looking for the WebResource.axd / ScriptResource.axd will return a 404 error.If the decryption key was not successfully guessed it will get a 500 error for the padding invalid exception. At this point the attack application knows to increment the potential decryption key value and try again repeating until it finds the first successful 404 from the WebResource.axd / ScriptResource.axd
i am trying to create a strong name for assembly.....by giving the below code----
assembly: AssemblyDelaySign(false)] assembly: AssemblyKeyFile(@"UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityinDebugABC.snk")] assembly: AssemblyKeyName("")]
when i am compiling project i am getting this error........
Error 1 Cryptographic failure while signing assembly 'C:UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityobjReleasecodeaccesssecurity.exe' -- 'Error reading key file 'UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityinDebugABC.snk' -- The system cannot find the path specified. '
Just reading about this ASP.NET security vurnerability. Just wondering if this could be used to attack a WCF service hosted under IIS to get to its web.config or if its a pure ASP.NET vurnerability
I am trying to find a solution to control the number of logins on asp.net application. I need to install the application in the client server, and set the number of licences. e.g. only 10 users are allowed to access the app.
Every time someone tries to login I need to check how many user are logged in, compare with the total allowed then authorize that user to proceed.
I tried with Certificate, but I couldn't see where to match the number of logged in users with the max number of allowed user.
Also I would like to use the IP address as identifier, then if I open 3 browser windows, it count only one user logged.
Basically this web application will be sold by licences. We need to control the logins per computer, and not per user, and block logins if the limit of logins are reached.
When I view a page in browser it throws following error.
Could not load file or assembly 'Microsoft.Licensing.Permutation_f50a9_2.0(1907)' or one of its dependencies. The parameter is incorrect. (Exception from HRESULT: 0x80070057 (E_INVALIDARG))
Description:
An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.IO.FileLoadException: Could not load file or assembly 'Microsoft.Licensing.Permutation_f50a9_2.0(1907)' or one of its dependencies. The parameter is incorrect. (Exception from HRESULT: 0x80070057 (E_INVALIDARG))
Our asp.net 2.0 app encountered the following error:
This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.After adding the following in web.config -> <system.web> section:
I'm developing my first commercial server control and I was wondering how people manage licensing and piracy. Is there a product that will help with managing demo/paid version? Keep the license from being passed around and abused?
I am working with a precompiled ASP.net website. I have most of the *.aspx.vb files, but I am missing some of the library files, and only have the DLLs. Can I still selectively compile aspx.vb files? When I just hit build, It errors with 'This application is already precompiled'
I've uploaded a simple Azure website (am testing out authentication) and have found this:http://mateerweb.cloudapp.net/ (live for next 12 hours or so!)Its supposed to look like this:Problem: How to get the live version looking like the test one on every deploy. After a recompile sometimes it works..
I have deployed my asp.net 2.0 website on IIS, and I tested there by browsing website in IIS and it's working fine. But I am getting the below error while browsing the websiteConfiguration Error Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately. Parser Error Message: Unrecognized attribute 'xmlns'.Source Error:
Previously when we used to create a website in IIS, it worked fine. I have checked the website folder in IIS [ By clicking Property > ASP.NET] and the framwework tageted there is 1.1, and it is in read only mode. If the problem is related to this issue than please let me know how to change it.
I have created a simple app with a page having a server side form, three fields and a button that submits and performs two operations - 1) adds the form fields to the database table 2) sends an email. Now everything works fine on the web browser on my machine but when I access the app through my mobile, the page does not seem to work. the UI and all are set but the button click functionality doesnt seem to be working and also the label which is set after a successful submit is already visible and showing the "thank you" message. Am i doing something wrong here? I have checked the app on Nokia Smartphone browser, android phone, and iphone simulator.
I have a new website that I'm trying to deploy. It works great on my local machine, but when I install on the server, it no longer works and I don't get any error messages. I'm using SQL Server Express, but this isn't installed on the server
I am sending the following xml to access a website and getting the error with the stack. I have spent weeks on it and getting no where. I am willing to pay for the advice as well, as I am getting sick of this!
i have deployed my new website in IIS when i tested in browser its working fine but its not working on network systems,i have my old website with port 3185 and new one is 3186 , the old one is working fine but the new web is not working
Login not working after publishing asp.net website
I am used default login control, form based authentication and default sqlmembership provider.but in local my site working fine,when i publish it locally in iis means,the login is not working , i don't know what is the reason?
I developed and deployed a web application using ASP.NET,C# successfully. The application was running perfectly until few days back. [NOTE: It still works fine on local machine (tested using both development server and IIS)] What happens now is: The website opens perfectly. After few operations which involves database interactions, in all the pages, the pages stop responding. I mean, after a few clicks, if I try another operation the page starts postback for unlimited time period and never gets rendered and a following message is given: The connection was reset: Firefox 3.5... IE cannot display the web page: IE 7, 8 There is no database connectivity issues. I checked event logs on the web server and found few unhandlled exceptions, I corrected those. Now the event log doesn't show any error. But the problem is same.
I tried accessing the page from web server's browser, everything works fine. Even my boss can browse all pages with no problem (both have Win Server installed). Other machines (mostly XP) can't browse after sometime(as described above). I checked the memory usage, cpu time - NO ISSUES.
