Search Results

Search found 3707 results on 149 pages for 'secure'.

Page 104/149 | < Previous Page | 100 101 102 103 104 105 106 107 108 109 110 111  | Next Page >

• Restlets with Google App Engine, Java Server Pages, (JSP's), and Shiro authentication

  - by DutrowLLC

  I'm having difficulty integrating Restlets into my project. I'm using google app engine (GAE) and I also have some java server pages (JSPs) set up. The JSP's never seem to work at the same time as the Restlets, should I only be using one or the other in GAE? I'm also using Shiro (formerly Ki, formerly JSecurity) and I have been unable to get Restlets to work with Shiro's filter for authentication. Are there any issues in particular that I should be aware of? What are other people using to secure restlet apps on GAE? Is Shiro overkill if I just need authentication and some role-based authorization? Thanks so much! Chris

  Read the article

• Adobe Socket Policy File Server Problems

  - by Matt

  Has anyone been able to successfully implement a service to serve the required socket policy file to FlashPlayer? I am running the Python implementation of the service provided by Adobe at http://www.adobe.com/devnet/flashplayer/articles/socket_policy_files.html and using the following policy file: <?xml version="1.0" encoding="UTF-8"?> <cross-domain-policy> <site-control permitted-cross-domain-policies="master-only"/> <allow-access-from domain="*" to-ports="*" secure="false"/> </cross-domain-policy> and receiving this message from Flash: [SecurityErrorEvent type="securityError" bubbles=false cancelable=false eventPhase=2 text="Error #2048: Security sandbox violation: http://www.mapopolis.com/family/Tree.swf cannot load data from www.mapopolis.com:1900."] Thanks.

  Read the article

• Does the android market use your merchant API callback URL during the Google checkout process for pa

  - by tootflow

  If I have a paid app on Android Market, will my merchant API callback URL get a hit when the customer goes to check out? I am wondering how merchants/vendors/developers secure their applications for android market. I have used google checkout before to implement a custom integration, so I understand how that all works. What I do not see anywhere that I have looked is what, if any, integration does the merchant/developer have with the Android Market checkout process? I understand that the market uses google checkout, but in that case the market hosts the checkout process and not the merchant, so it's not clear whether they give your URL a call. So where is the hook? Am I right in assuming it is the merchant API callback URL?

  Read the article

• Java Memory Management

  - by Tara Singh

  I am designing a client-server chat application in Java. This is a secure application where the messages are exchanged using cryptographic algorithms. I have one server and it can support many clients. My problem is that when one client logs on the server it works fine, but when another user logs into the system, the server starts giving me bad padding exceptions for the encrypted text. I am not able to figure out the problem, according to my logic, when new connection request to server is made, the server creates a thread for listening to the client. Is it possible that once the instance of thread class is created, it does all the processing correctly for the first client, but not for the second client because the variables in server listener thread class already have some previous value, and thus the encrypted text is not decrypted properly? Please advise how I can make this process more robust so that the number of clients does not affect how well the server functions.

  Read the article

• Loading and storing encryption keys from a config source

  - by Hassan Syed

  I am writing an application which has an authenticity mechanism, using HMAC-sha1, plus a CBC-blowfish pass over the data for good measure. This requires 2 keys and one ivec. I have looked at Crypto++ but the documentation is very poor (for example the HMAC documentation). So I am going oldschool and use Openssl. Whats the best way to generate and load these keys using library functions and tools ? I don't require a secure-socket therefore a x.509 certificate probably does not make sense, unless, of-course, I am missing something. So, do I need to write my own config file, or is there any infrastructure in openssl for this ? If so, could you direct me to some documentation or examples for this.

  Read the article

• Need a Security Scenario for asp.net webservice

  - by Karamafrooz

  I have developed a .Net 3.5 windows forms application. I also want to design a website that has a webservice with multiple Webmethods to query the database on the host machine. I want the webservice to be called ONLY through my winapp and my website! And I don't want any other people to be able to call and use my webservice but only some people who have access to the windows application that I have developed. I need a good security scenario for this! I truly appreciate anyone who can help me because this is my first experience of developing a webservice and I really need it to be as secure as I mentioned!

  Read the article

• Recieving server broadcast on mobile in real time

  - by Manjoor

  I have to write a simple mobile application that is able to recieve broadcast from a server, connected using GPRS, over a secure SSL connection. The amount of data mobile need to recieve is very small (about 100 character string for a single broadcast and maximum 10 broadcast per minute) I need to display it on screen and generate a alert sound (and vibrate the device). Client need not to send anything back to server. (ofcourse at the time of intialization the client app need to send some data for authorization) The target mobile plateform is symbion S60 and Blackberry. How can i do this? What tools, SDK and Third party framework (if needed) i should use? I am familier with java and network programming but not for mobile device.

  Read the article

• free switch : what is tls_port ?

  - by kiruthika

  Hi all, I am beginner to free switch.I have gone through the configuration file vars.xml in free switch. In this I have seen the following configurations. <X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/> <X-PRE-PROCESS cmd="set" data="internal_sip_port=5070"/> <X-PRE-PROCESS cmd="set" data="internal_tls_port=5071"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=false"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${base_dir}/conf/ssl"/> In the above I am having the doubt with tls_port. What is the use of tls_port .I have searched about this in net and I have read that tls protocol is used for secure data transfer in network. So please explain me about the communication in freeswitch. Thanks in advance.

  Read the article

• Error while importing SSL into jboss 4.2 ?

  - by worldpython

  I've tried to setup .keystore on Jboss 4.2. due to this documentation from jboss community http://community.jboss.org/wiki/sslsetup but Jboss console generate this error LifecycleException: service.getName(): "jboss.web"; Protocol handler start failed: java.io.FileNotFoundException: C:\Documents and Settings\mebada\.keystore (The system cannot find the file specified) even I specify location of keystore in server.xml <Connector className = "org.apache.coyote.tomcat4.CoyoteConnector" address="${jboss.bind.address}" port = "8443" protocol="HTTP/1.1" SSLEnabled="true" scheme = "https" secure = "true"> <Factory className = "org.apache.coyote.tomcat4.CoyoteServerSocketFactory" keystoreFile="D:/Projects/Demo/jboss-4.2.3.GA/jboss-4.2.3.GA/server/default/conf/server.keystore" keystorePass="tc-ssl" protocol = "TLS"></Factory> Any Help ? Thanks in advance

  Read the article

• Public ASPXAUTH cookie and security

  - by Bara

  Due to a bug in Flash, I have to use the ASPXAuth cookie to log a user in on a page that a flash upload script calls after upload. See this page for more information: http://geekswithblogs.net/apopovsky/archive/2009/05/06/working-around-flash-cookie-bug-in-asp.net-mvc.aspx I have to make the ASPXAUTH string "public" in the sense that it will be in the HTML of the page. My question is, how secure is this? I understand that anyone that can get to the string in the HTML can probably get to it from the cookie just as easily, but let's say someone does have this ASPXAUTH string. Is it possible that they can login as another user using this cookie? Would they be able to decrypt it? Bara

  Read the article

• Best way to encrypt certain fiels in SQL Server 2008?

  - by Josh

  I'm writing a .net web app that will read and write information to a SQL 2008 backend database. Some of this information will be highly confidential in nature so I want to encrypt certain data elements. I dont want to use TDE or any full-database encryption for performance reasons. My main concern is protecting this sensitive data as a last resort against a SQL injection or even a database server compromise. My question is what is the best way to do this to preserve performance? Is it faster to use the SQL2008 encryption functions such as EncryptByKey, or would it be faster to encrypt and decrypt the data in the .NET web app itself using a symmetric key stored in the secure web.config and store the encrypted values in the DB?

  Read the article

• immutable strings vs std::string

  - by Caspin

  I've recent been reading about immutable strings, here and here as well some stuff about why D chose immutable strings. There seem to be many advantages. trivially thread safe more secure more memory efficient in most use cases. cheap substrings (tokenizing and slicing) Not to mention most new languages have immutable strings, D2.0, Java, C#, Python, Ruby, etc. Would C++ benefit from immutable strings? Is it possible to implement an immutable string class in c++ (or c++0x) that would have all of these advantages?

  Read the article

• Is writing eSQL database independant or not?

  - by Robert Koritnik

  Using EF we can use LINQ to read data which is rather simple (especialy using fluent calls), but we have less control unless we write eSQL on our own. Is writing eSQL database actually data store independant code? So if we decide to change data store, can the same statements still be used? Is writing eSQL strings in your code pose any serious security threats similar to writing TSQL statements in plain strings? So we moved to SPs. Could we still mode eSQL scripts outside of code as well and use some other technique to make them a bit more secure?

  Read the article

• Custom certificate as proof of transaction

  - by Andy

  I'm developing a site where a user conducts a given transaction and once completed, the user is issued with a 'secure certificate'. The certificate serves as proof of the transaction and the user is able to upload the certificate at a later stage, to view the details of the transaction. At the moment I'm using a custom XML document with encrypted fields. It works perfect, but I would like a standardized approach, such as an X.509 certificate. I'm no encryption expert, but from what I gather, X.509 is more geared towards SSL issued by a CA. Is it possible to create your own valid valid CRT file? As a test, I created a CRT file with the example provided on WikiPedia. However, when I open the file in Windows I get this warning: Invalid Public Key Security Object File - This file is invalid as the following: Security Certificate. Not having much luck here, so time to ask the experts. What direction should I be heading in? Any guidance would be greatly appreciated.

  Read the article

• Reading data from a socket, considerations for robustness and security

  - by w.brian

  I am writing a socket server that will implement small portions of the HTTP and the WebSocket protocol, and I'm wondering what I need to take into consideration in order to make it robust/secure. This is my first time writing a socket-based application so please excuse me if any of my questions are particularly naive. Here goes: Is it wrong to assume that you've received an entire HTTP request (WebSocket request, etc) if you've read all data available from the socket? Likewise, is it wrong to assume you've only received one request? Is TCP responsible for making sure I'm getting the "message" all at once as sent by the client? Or do I have to manually detect the beginning and end of each "message" for whatever protocol I'm implementing? Regarding security: What, in general, should I be aware of? Are there any common pitfalls when implementing something like this? As always, any feedback is greatly appreciated.

  Read the article

• friendly url in categories

  - by ntan

  Hi to all, i am trying to use friendly url for my categories. Example Database cat_id | parent_id | name | url 1 0 cat1 cat1 2 1 cat2 cat2 My approach to do is to pass the parameter cat with url value for example show.php?cat=cat1 and in .htaccess i must rewrite to /cat1 BUT what about when i want to access cat2. I want to rewrite as cat1/cat2 so the parameter is show.php?cat=cat1/cat2 and then parse the value to secure that cat2 belong to cat1. And so on. I am not using MVC so i have to do it on my own. Please if any other solutions is better please advice or suggest me reading Thank in advance.

  Read the article

• Implement a vpn

  - by jackson

  I want to build an application client(client.exe) - server to do the following: when the clients run it they are thrown in a VPN and they can communicate each other within 1 applicataion. For example : clients run client.exe and they can see each other in LAN ONLY in Starcraft. From what i have read the right type of vpn for this situation is Secured Socket Tunneling Protocol: "Secure socket tunneling protocol, also referred to as SSTP, is by definition an application-layer protocol. It is designed to employ a synchronous communication in a back and forth motion between two programs. It allows many application endpoints over one network connection, between peer nodes, thereby enabling efficient usage of the communication resources that are available to that network. " Question: I don't have experience with networking programming so my question for the ones who have, is this the right approach? PS1: i don't want something done like OpenVpn, i do this as learning exercise. PS2: the application is targeting Windows and i plan to use .NET Thanks for reading the whole story, i am waiting for your replies.

  Read the article

• iFrame src something other than javascript:false but same effect

  - by macca1

  Is there any other way to write javascript:false that is more pleasant? I'm building a print functionality for an intranet app (for IE6) and I make the printed page using an iframe: $('body').append('<iframe id="printIFrame" src="javascript:false"></iframe>'); $("#printIFrame").attr('style','position:absolute;left:-500px;top:-500px;'); Without having javascript:false in the src, I'll get the "This page contains both secure and nonsecure items" popup when I create it. However the downside of this is that "javascript:false" gets printed as the title on the bottom left of each page (instead of about:blank or something more useful). Is there some kind of javascript technique that I can write javascript:false but in cleaner terms? I tried something like this var PrintOut = false; $('body').append('<iframe id="printIFrame" src="PrintOut"></iframe>'); But I couldn't get that working. Any other ideas?

  Read the article

• Concepts a web application developer should know?

  - by iama

  I think it is imperative for web application developers to know the answers surrounding the following general questions on web development irrespective of the programming language/framework used. What authentication mechanisms HTTP offer & what are their pros and cons? Why should one go for FORMS authentication? How to secure authentication or for that matter any transactions via HTTP? How to maintain state in HTTP? What are the downsides to maintaining state via cookie & what happens when browsers disable them? Security issues like cross site scripting, session hijacking etc. What other questions a web developer should have answers for similar to the ones above that are programming language/web framework agnostic?

  Read the article

• Kohana input & validation libraries - overlap?

  - by keithjgrant

  I'm familiarizing myself with Kohana. I've been reading up on the Input library, which automatically pre-filters GET and POST data for me, and the Validation libary, which helps with form validation. Should I use both together? The examples given in the Validation library documentation use the unfiltered $_POST array instead of $this->input->post(). Seems to me it would be more secure to chain the two, but the two sets of documentation seem to make no mention of each other, so I don't know if this would be redundant or not.

  Read the article

• Maintaining session across relay domain?

  - by Steffen

  I'm building a payment page in asp.net, however the page where you order your items is run in HTTP (non-secure) on my domain. When redirecting the user to the payment site, I have to go through a different domain (my payment provider, from whom I borrow the SSL certificate), so my payment url ends up like https://www.paymentprovider.com/somescript.cgi/www.mydomain.com/mypaymentpage.aspx Now the problem is my session is lost, but I store the order in session, so I desperately needs it. Can I somehow send the SessionID in querystring, and restore the session from it - or do I need to stuff the entire order into querystring ? (Not too certain it'll fit though, it's rather long) Any help will be highly appreciated :-)

  Read the article

• SSRS 2008 Snapshotting Security

  - by Holy Christ

  Hi, I'm writing a report that will show data based on the User!UserID built into the SSRS infrastructure. The data is sensitive to the user's department. In addition to these department users, there will be admins that should be able to run for all departments, or have a report parameter to run for a specific department. Ideally, I'd like to use SSRS snapshotting so that users can rerun a report they ran on a previous date. It's important that a user can only view the snapshots he created for his department. My questions are: 1.) Does SSRS snapshotting provide a mechanism to limit viewing snapshots by the user that created them? 2.) Will I need to write two reports, one for the admin and one for the department users? I think I do since there isn't a way to secure report parameters. Thanks!

  Read the article

• ReturnUrl = Default.aspx for MVC?

  - by Cynthia

  I'm trying to secure my entire MVC site, so before the Home controller, I added an [Authorize] attribute. Now if you run it from Visual Studio or navigate using the root URL (e.g. http://localhost:2897) it does redirect to the login page, as expected. However the URL in the address bar after redirection looks like this: http://localhost:2897/Account/LogOn?ReturnUrl=%2fdefault.aspx%3f I haven't tested this out, seeing as I have not implemented my authentication code. However, this looks like a big problem to me, since I do not have a default.aspx in my project! My authentication tag in the web.config looks like this: <authentication mode="Forms"> <forms loginUrl="~/Account/LogOn" defaultUrl="~/Home/Index" timeout="2880"/> </authentication> Why doesn't it pick up this route as the default ReturnUrl instead of default.aspx?

  Read the article

• What fields have job security?

  - by computergeek6

  I can program pretty well, and I'm trying to think of a programming area that I can practice so I have a better chance of getting a job when I finish my education. I'm currently learning game development, but there are a ton of other people trying to get into game dev, so I want to find something a little more secure and sustainable to develop skills in. I've thought of things like financial systems and engineering stuff, but nothing I can think of is accessible to someone in high school. I'm trying to find something that involves physics or networking and isn't as popular a field as game dev. Does anyone have any ideas?

  Read the article

• Protect .NET assemblies from decomplie

  - by Holli

  One if the first things I learned when I started with C# was the most important one. You can decompile any .NET assembly with Reflector or other tools. Many developers are not aware of this fact and most of them are shocked when I show them their source code. Protection against decompilation is still a difficult task. I am still looking for a fast, easy and secure way to do it. I don't want to obfuscate my code so my method names will be a,b,c or so. Reflector or other tools should be unable to recognize my application as .NET assembly at all. I know about some tools already but they are very expensive. Is there any other way to protect my applications?

  Read the article

< Previous Page | 100 101 102 103 104 105 106 107 108 109 110 111  | Next Page >