Search Results

Search found 10480 results on 420 pages for 'session cookies'.

Page 241/420 | < Previous Page | 237 238 239 240 241 242 243 244 245 246 247 248  | Next Page >

  • Ruby on Rails Mysterious Javascript Alert box with cookie information

    - by conorgil
    I have a problem in a Ruby on Rails app that I am working on. I have been working on the app for months and I have never had this problem before and after a bit of Google searches I think that somehow someone is trying to steal cookies with javascript. When I click on the link I get an alert box titled "the page at www.napkinboard.com says:" and contains the following message: __utmz=217223433.1270652009.59.3.utmcsr=localhost:3000|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=217223433.2133018314.1265749085.1271097412.1271125626.63; __utmc=217223433; __utmb=217223433.11.10.1271125626 I checked the database and all data associated with this 'food_item' looks completely normal and does not contain any javascript at all. How did this suddenly happen and how can I stop it? I appreciate any help. Thanks.

    Read the article

  • Cross domain cookie reading/setting cross browsers

    - by Rac123
    I know there are already a few threads available here on this subject but I want others' opinion on this. There are two ways to set/read the cross domain cookies: Creating IFrame on A.com pointing to a page on B.com which creates the cookie and pass that information by creating another IFrame on B.com side pointing to A.com, either using window.name or in location.href.hash A.com page makes a XHR/JSONP call to B.com web service/page that has the following headers and it also sets up the cookie and returns the value. AddHeader("p3p", "CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"") As we don't have postMessage available across all the browsers, I believe we have to go with one of the cases mentioned above. My question is which is a better way (cleaner) and why to implement for cross browser. Using any other JS framework is out of scope of this discussion. If there's another better way, please mention here! Thank you for your intelligent input in advance! :)

    Read the article

  • Review my ASP.NET Authentication code.

    - by Niels Bosma
    I have had some problems with authentication in ASP.NET. I'm not used most of the built in authentication in .NET. I gotten some complaints from users using Internet Explorer (any version - may affect other browsers as well) that the login process proceeds but when redirected they aren't authenticated and are bounced back to loginpage (pages that require authentication check if logged in and if not redirect back to loginpage). Can this be a cookie problem? Do I need to check if cookies are enabled by the user? What's the best way to build authentication if you have a custom member table and don't want to use ASP.NET login controls? Here my current code: using System; using System.Linq; using MyCompany; using System.Web; using System.Web.Security; using MyCompany.DAL; using MyCompany.Globalization; using MyCompany.DAL.Logs; using MyCompany.Logging; namespace MyCompany { public class Auth { public class AuthException : Exception { public int StatusCode = 0; public AuthException(string message, int statusCode) : base(message) { StatusCode = statusCode; } } public class EmptyEmailException : AuthException { public EmptyEmailException() : base(Language.RES_ERROR_LOGIN_CLIENT_EMPTY_EMAIL, 6) { } } public class EmptyPasswordException : AuthException { public EmptyPasswordException() : base(Language.RES_ERROR_LOGIN_CLIENT_EMPTY_PASSWORD, 7) { } } public class WrongEmailException : AuthException { public WrongEmailException() : base(Language.RES_ERROR_LOGIN_CLIENT_WRONG_EMAIL, 2) { } } public class WrongPasswordException : AuthException { public WrongPasswordException() : base(Language.RES_ERROR_LOGIN_CLIENT_WRONG_PASSWORD, 3) { } } public class InactiveAccountException : AuthException { public InactiveAccountException() : base(Language.RES_ERROR_LOGIN_CLIENT_INACTIVE_ACCOUNT, 5) { } } public class EmailNotValidatedException : AuthException { public EmailNotValidatedException() : base(Language.RES_ERROR_LOGIN_CLIENT_EMAIL_NOT_VALIDATED, 4) { } } private readonly string CLIENT_KEY = "9A751E0D-816F-4A92-9185-559D38661F77"; private readonly string CLIENT_USER_KEY = "0CE2F700-1375-4B0F-8400-06A01CED2658"; public Client Client { get { if(!IsAuthenticated) return null; if(HttpContext.Current.Items[CLIENT_KEY]==null) { HttpContext.Current.Items[CLIENT_KEY] = ClientMethods.Get<Client>((Guid)ClientId); } return (Client)HttpContext.Current.Items[CLIENT_KEY]; } } public ClientUser ClientUser { get { if (!IsAuthenticated) return null; if (HttpContext.Current.Items[CLIENT_USER_KEY] == null) { HttpContext.Current.Items[CLIENT_USER_KEY] = ClientUserMethods.GetByClientId((Guid)ClientId); } return (ClientUser)HttpContext.Current.Items[CLIENT_USER_KEY]; } } public Boolean IsAuthenticated { get; set; } public Guid? ClientId { get { if (!IsAuthenticated) return null; return (Guid)HttpContext.Current.Session["ClientId"]; } } public Guid? ClientUserId { get { if (!IsAuthenticated) return null; return ClientUser.Id; } } public int ClientTypeId { get { if (!IsAuthenticated) return 0; return Client.ClientTypeId; } } public Auth() { if (HttpContext.Current.User.Identity.IsAuthenticated) { IsAuthenticated = true; } } public void RequireClientOfType(params int[] types) { if (!(IsAuthenticated && types.Contains(ClientTypeId))) { HttpContext.Current.Response.Redirect((new UrlFactory(false)).GetHomeUrl(), true); } } public void Logout() { Logout(true); } public void Logout(Boolean redirect) { FormsAuthentication.SignOut(); IsAuthenticated = false; HttpContext.Current.Session["ClientId"] = null; HttpContext.Current.Items[CLIENT_KEY] = null; HttpContext.Current.Items[CLIENT_USER_KEY] = null; if(redirect) HttpContext.Current.Response.Redirect((new UrlFactory(false)).GetHomeUrl(), true); } public void Login(string email, string password, bool autoLogin) { Logout(false); email = email.Trim().ToLower(); password = password.Trim(); int status = 1; LoginAttemptLog log = new LoginAttemptLog { AutoLogin = autoLogin, Email = email, Password = password }; try { if (string.IsNullOrEmpty(email)) throw new EmptyEmailException(); if (string.IsNullOrEmpty(password)) throw new EmptyPasswordException(); ClientUser clientUser = ClientUserMethods.GetByEmailExcludingProspects(email); if (clientUser == null) throw new WrongEmailException(); if (!clientUser.Password.Equals(password)) throw new WrongPasswordException(); Client client = clientUser.Client; if (!(bool)client.PreRegCheck) throw new EmailNotValidatedException(); if (!(bool)client.Active || client.DeleteFlag.Equals("y")) throw new InactiveAccountException(); FormsAuthentication.SetAuthCookie(client.Id.ToString(), true); HttpContext.Current.Session["ClientId"] = client.Id; log.KeyId = client.Id; log.KeyEntityId = ClientMethods.GetEntityId(client.ClientTypeId); } catch (AuthException ax) { status = ax.StatusCode; log.Success = status == 1; log.Status = status; } finally { LogRecorder.Record(log); } } } }

    Read the article

  • Will client side performance improve if images/scripts/styles on different subdomains?

    - by Andrey
    Hi, I have a domain specifically for static content, so cookies don't travel along with requests to images/scripts/css. Now, I think I've read somewhere that most browsers only open one download thread for each domain/subdomain, so different static content can't be downloaded in parallel if on the same domain. Will it make difference for browsers if i place scripts in script.mycdn.com, styles in css.mycdn.com and images in images.mycdn.com? Will it allow to let browser download images at the same time as scripts and styles? mycdn.com is of course a made up name :) Thanks! Andrey

    Read the article

  • Can YQL parse web sites requiring cookie-based authentication?

    - by user249488
    First, my use case: I'm trying to use YQL's built in XPATH capabilities to scrape content from Yahoo! Fantasy Sports. It uses some sort of cookie-based authentication scheme. Basically, the sequence is: 1) Do an HTTP GET on the Yahoo! Login page 2) Parse the hidden inputs from the response and do an HTTP PUT with your Yahoo! Login on the form URL 3) Use the cookies returned from step 2 to GET any of the Fantasy Sports! websites that you have access to My question is, does YQL support doing this to scrape data? The only authentication based examples I've seen use OAuth, but I haven't seen any examples of using YQL to parse websites with cookie-based authentication schemes

    Read the article

  • Facebook connect JavaScript with PHP

    - by skidding
    I'm using the JavaScript method to sync/login (with the popup) with Facebook Connect on my site, it seems to work. However, after I get logged in, I want to continue in backend, with the PHP library. I see the cookies are set by the JavaScript lib, but I don't know how to use them with the PHP api. I used $fb = new Facebook($api_key, $secret); $uid = $fb->get_loggedin_user(); but not user data is getting passed. How can I get the user data in PHP after I logged in in frontend? As far as I'm concerned, I would have gone PHP all the way, but I didn't manage to make the auth work, meaning that in never redirected me back to my site :). Thanks!

    Read the article

  • [jQuery] JSON response is null, but the URL is echoing correctly.

    - by b. e. hollenbeck
    I have a form being AJAX'd in by jQuery on a page with multiple forms. I'm performing the following function, which is a wrapper for the $.ajax function: function do_json_get(uri){ var ret = ''; var url = AJAX_URL + uri; $.ajax({ type: 'GET', url: url, async: false, success: function(data) { ret = data.html; }, dataType: 'json' }); return ret; } When I go to the AJAX server directly (which is rendering the form in PHP), I get the raw JSON response - so I know the server is outputting to the browser, and the AJAX server is doing other things like setting the proper cookies, so I know that the connection is good (I get a 200 response code). Yet the data object is coming back null. What else could I be missing?

    Read the article

  • How can I connect to a mail server using SMTP over SSL using Python?

    - by jakecar
    Hello, So I have been having a hard time sending email from my school's email address. It is SSL and I could only find this code online by Matt Butcher that works with SSL: import smtplib, socket version = "1.00" all = ['SMTPSSLException', 'SMTP_SSL'] SSMTP_PORT = 465 class SMTPSSLException(smtplib.SMTPException): """Base class for exceptions resulting from SSL negotiation.""" class SMTP_SSL (smtplib.SMTP): """This class provides SSL access to an SMTP server. SMTP over SSL typical listens on port 465. Unlike StartTLS, SMTP over SSL makes an SSL connection before doing a helo/ehlo. All transactions, then, are done over an encrypted channel. This class is a simple subclass of the smtplib.SMTP class that comes with Python. It overrides the connect() method to use an SSL socket, and it overrides the starttles() function to throw an error (you can't do starttls within an SSL session). """ certfile = None keyfile = None def __init__(self, host='', port=0, local_hostname=None, keyfile=None, certfile=None): """Initialize a new SSL SMTP object. If specified, `host' is the name of the remote host to which this object will connect. If specified, `port' specifies the port (on `host') to which this object will connect. `local_hostname' is the name of the localhost. By default, the value of socket.getfqdn() is used. An SMTPConnectError is raised if the SMTP host does not respond correctly. An SMTPSSLError is raised if SSL negotiation fails. Warning: This object uses socket.ssl(), which does not do client-side verification of the server's cert. """ self.certfile = certfile self.keyfile = keyfile smtplib.SMTP.__init__(self, host, port, local_hostname) def connect(self, host='localhost', port=0): """Connect to an SMTP server using SSL. `host' is localhost by default. Port will be set to 465 (the default SSL SMTP port) if no port is specified. If the host name ends with a colon (`:') followed by a number, that suffix will be stripped off and the number interpreted as the port number to use. This will override the `port' parameter. Note: This method is automatically invoked by __init__, if a host is specified during instantiation. """ # MB: Most of this (Except for the socket connection code) is from # the SMTP.connect() method. I changed only the bare minimum for the # sake of compatibility. if not port and (host.find(':') == host.rfind(':')): i = host.rfind(':') if i >= 0: host, port = host[:i], host[i+1:] try: port = int(port) except ValueError: raise socket.error, "nonnumeric port" if not port: port = SSMTP_PORT if self.debuglevel > 0: print>>stderr, 'connect:', (host, port) msg = "getaddrinfo returns an empty list" self.sock = None for res in socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM): af, socktype, proto, canonname, sa = res try: self.sock = socket.socket(af, socktype, proto) if self.debuglevel > 0: print>>stderr, 'connect:', (host, port) self.sock.connect(sa) # MB: Make the SSL connection. sslobj = socket.ssl(self.sock, self.keyfile, self.certfile) except socket.error, msg: if self.debuglevel > 0: print>>stderr, 'connect fail:', (host, port) if self.sock: self.sock.close() self.sock = None continue break if not self.sock: raise socket.error, msg # MB: Now set up fake socket and fake file classes. # Thanks to the design of smtplib, this is all we need to do # to get SSL working with all other methods. self.sock = smtplib.SSLFakeSocket(self.sock, sslobj) self.file = smtplib.SSLFakeFile(sslobj); (code, msg) = self.getreply() if self.debuglevel > 0: print>>stderr, "connect:", msg return (code, msg) def setkeyfile(self, keyfile): """Set the absolute path to a file containing a private key. This method will only be effective if it is called before connect(). This key will be used to make the SSL connection.""" self.keyfile = keyfile def setcertfile(self, certfile): """Set the absolute path to a file containing a x.509 certificate. This method will only be effective if it is called before connect(). This certificate will be used to make the SSL connection.""" self.certfile = certfile def starttls(): """Raises an exception. You cannot do StartTLS inside of an ssl session. Calling starttls() will return an SMTPSSLException""" raise SMTPSSLException, "Cannot perform StartTLS within SSL session." And then my code: import ssmtplib conn = ssmtplib.SMTP_SSL('HOST') conn.login('USERNAME','PW') conn.ehlo() conn.sendmail('FROM_EMAIL', 'TO_EMAIL', "MESSAGE") conn.close() And got this error: /Users/Jake/Desktop/Beth's Program/ssmtplib.py:116: DeprecationWarning: socket.ssl() is deprecated. Use ssl.wrap_socket() instead. sslobj = socket.ssl(self.sock, self.keyfile, self.certfile) Traceback (most recent call last): File "emailer.py", line 5, in conn = ssmtplib.SMTP_SSL('HOST') File "/Users/Jake/Desktop/Beth's Program/ssmtplib.py", line 79, in init smtplib.SMTP.init(self, host, port, local_hostname) File "/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/smtplib.py", line 239, in init (code, msg) = self.connect(host, port) File "/Users/Jake/Desktop/Beth's Program/ssmtplib.py", line 131, in connect self.sock = smtplib.SSLFakeSocket(self.sock, sslobj) AttributeError: 'module' object has no attribute 'SSLFakeSocket' Thank you!

    Read the article

  • Integrating Simple Machines Forum in my custom membership site - login not working?

    - by Ali
    Hi guys I'm trying to integrate simple machines forum into my custom made membership website. I'm using the SMF API which is available here at http://download.simplemachines.org/?tools. The thing is that its working on my localhost testing server - however on my online server where the system is hosted - its not working. I have set it up so that when the user log into my own custom CMS membership site, he/she is logged in automatically to his/her corresponding account on the forum. However it works on my localhost but online its not working at all.. I log into my site and then browse to the forum to find out I havent been logged in there :( - I think its not creating the cookies or registering the session.. where should I look here. Please do help.

    Read the article

  • Good way to capture/replay sessions from Apache Log?

    - by Mark Harrison
    For performance testing, I would like to capture some traffic from a production server and use that as a basis to replay the request to a test server in order to simulate a realistic load in our development environment. These are all stateless queries, so no issues regarding cookies, sessions, etc. The Apache log timestamps everything down to a 1 second resolution, but that's not fine enough granularity for our peak times. What's the best way to capture more fine-grained timestamps for replay? And is there some ab-like load generating program that can use this data to replicate load?

    Read the article

  • Java textfile I/O problem

    - by KáGé
    Hello, I have to make a torpedo game for school with a toplist for it. I want to store it in a folder structure near the JAR: /Torpedo/local/toplist/top_i.dat, where the i is the place of that score. The files will be created at the first start of the program with this call: File f; f = new File(Toplist.toplistPath+"/top_1.dat"); if(!f.exists()){ Toplist.makeToplist(); } Here is the toplist class: package main; import java.awt.Color; import java.io.BufferedReader; import java.io.File; import java.io.FileNotFoundException; import java.io.FileReader; import java.io.FileWriter; import java.io.IOException; import java.io.PrintWriter; import java.text.SimpleDateFormat; import java.util.Calendar; import java.util.prefs.Preferences; import javax.swing.JFrame; import javax.swing.JOptionPane; import javax.swing.JTextArea; public class Toplist { static String toplistPath = "./Torpedo/local/toplist"; //I know it won't work this easily, it's only to get you the idea public static JFrame toplistWindow = new JFrame("Torpedó - [TOPLISTA]"); public static JTextArea toplist = new JTextArea(""); static StringBuffer toplistData = new StringBuffer(3000); public Toplist() { toplistWindow.setSize(500, 400); toplistWindow.setLocationRelativeTo(null); toplistWindow.setResizable(false); getToplist(); toplist.setSize(400, 400); toplist.setLocation(0, 100); toplist.setColumns(5); toplist.setText(toplistData.toString()); toplist.setEditable(false); toplist.setBackground(Color.WHITE); toplistWindow.setLayout(null); toplistWindow.setVisible(true); } public Toplist(Player winner) { //this is to be done yet, this will set the toplist at first and then display it toplistWindow.setLayout(null); toplistWindow.setVisible(true); } /** * Creates a new toplist */ public static void makeToplist(){ new File(toplistPath).mkdir(); for(int i = 1; i <= 10; i++){ File f = new File(toplistPath+"/top_"+i+".dat"); try { f.createNewFile(); } catch (IOException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista létrehozása", "Error", JOptionPane.ERROR_MESSAGE); } } } /** * If the score is a top score it inserts it into the list * * @param score - the score to be checked */ public static void setToplist(int score, Player winner){ BufferedReader input = null; PrintWriter output = null; int topscore; for(int i = 1; i <= 10; i++){ try { input = new BufferedReader(new FileReader(toplistPath+"/top_"+i+",dat")); String s; topscore = Integer.parseInt(input.readLine()); if(score > topscore){ for(int j = 9; j >= i; j--){ input = new BufferedReader(new FileReader(toplistPath+"/top_"+j+".dat")); output = new PrintWriter(new FileWriter(toplistPath+"/top_"+(j+1)+".dat")); while ((s = input.readLine()) != null) { output.println(s); } } output = new PrintWriter(new FileWriter(toplistPath+"/top_"+i+".dat")); output.println(score); output.println(winner.name); if(winner.isLocal){ output.println(Torpedo.session.remote.name); }else{ output.println(Torpedo.session.remote.name); } output.println(Torpedo.session.mapName); output.println(DateUtils.now()); break; } } catch (FileNotFoundException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista frissítése", "Error", JOptionPane.ERROR_MESSAGE); } catch (IOException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista frissítése", "Error", JOptionPane.ERROR_MESSAGE); } finally { if (input != null) { try { input.close(); } catch (IOException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista frissítése", "Error", JOptionPane.ERROR_MESSAGE); } } if (output != null) { output.close(); } } } } /** * This loads the toplist into the buffer */ public static void getToplist(){ BufferedReader input = null; toplistData = null; String s; for(int i = 1; i <= 10; i++){ try { input = new BufferedReader(new FileReader(toplistPath+"/top_"+i+".dat")); while((s = input.readLine()) != null){ toplistData.append(s); toplistData.append('\t'); } toplistData.append('\n'); } catch (FileNotFoundException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista betöltése", "Error", JOptionPane.ERROR_MESSAGE); } catch (IOException e) { JOptionPane.showMessageDialog(new JFrame(), "Fájl hiba: toplista betöltése", "Error", JOptionPane.ERROR_MESSAGE); } } } /** * * @author http://www.rgagnon.com/javadetails/java-0106.html * */ public static class DateUtils { public static final String DATE_FORMAT_NOW = "yyyy-MM-dd HH:mm:ss"; public static String now() { Calendar cal = Calendar.getInstance(); SimpleDateFormat sdf = new SimpleDateFormat(DATE_FORMAT_NOW); return sdf.format(cal.getTime()); } } } The problem is, that it can't access any of the files. I've tried adding them to the classpath and at least six different variations of file/path handling I found online but nothing worked. Could anyone tell me what do I do wrong? Thank you.

    Read the article

  • Cannot login to drupal in Chrome or Firefox, but Safari works

    - by WmasterJ
    Problem: Login is not working in Firefox and Chrome but it does in Safari. Details: We just moved a drupal 6 installation to another host and followed some steps: Moved sites/site1/Themes/themeFolder to sites/all/Themes/themeFolder Made these changes in page-node-NNN.tpl.php files (searched all files in themes/themeFolder): 1) find: /oldpath/ replace: /newpath/ 2) find: oldsubdomain. replace: www. 3) find: .com/sites/ replace: .com/newpath/sites/ Then as I login it fails in any browser when the wrong information is entered but when it is correct it simply redirects to that users profile page...and then nothing. There are no admin menus, no edit buttons for content and it is a though it authenticated but somehow never stored anything that would help with the authentication later. The strange thing is that for 3 people with three different systems Firefox and Chrome don't work. But Safari does. We have ruled out that it is the database or old cookies. Any one have a good guess?

    Read the article

  • Perl "Day too big" - root cause

    - by azp74
    I have been helping someone debug some code where the error message was "Day too big". I know that this springs from localtime and the Y2038 bug (most google results appear to be people dealing with cookies expiring well into the future). We appear to have 'fixed' the problem by using time to get the current date. However, given that none of our original dates should have hit the 2038 issue I'm sceptical that we've actually fixed the problem ... Are there other instances that anyone knows of where one would hit "day too big"?

    Read the article

  • Get objc_exception_throw when setting cookie with ASIHTTPRequest

    - by TuanCM
    I got objc_exception_throw when trying to set cookies for a ASIHTTPRequest request. I tried both of these but it didn't work out. ASIHTTPRequest *request = [[ASIHTTPRequest alloc] initWithURL:url]; NSMutableDictionary *properties = [[NSMutableDictionary alloc] init]; [properties setValue:@".google.com" forKey:@"Domain"]; [properties setValue:@"/" forKey:@"path"]; [properties setValue:@"1600000000" forKey:@"expires"]; NSHTTPCookie *cookie = [[NSHTTPCookie alloc] initWithProperties:properties]; [request setRequestCookies:[NSMutableArray arrayWithObject:cookie]]; or replacing initiating code for cookie with this one NSHTTPCookie *cookie = [[NSHTTPCookie alloc] init]; When I commented out the following line, everything worked fine. [request setRequestCookies:[NSMutableArray arrayWithObject:cookie]]; Can you guys tell me what the problem here!

    Read the article

  • Windows secure pinned website tile

    - by Stijn de Voogd
    I'm currently working on a pinned website tile for my website and instead of using a static XML file i'm linking the tile to a web api that returns user specific XML. My question is: Is it possible to secure this tile so that a user needs to be logged in before the data loads? The pinned website livetile doesn't send any security request headers/ cookies: - Http: Request, GET /v1/livetile/firsttile Command: GET + URI: /v1/livetile/firsttile ProtocolVersion: HTTP/1.1 UserAgent: Microsoft-WNS/6.3 Host: 192.168.14.109:2089 Cache-Control: no-cache HeaderEnd: CRLF Sidenote: Notice how it's not even sending an accept header even though it only wants xml. Info: http://msdn.microsoft.com/en-US/library/ie/dn455106 http://msdn.microsoft.com/en-us/library/ie/hh761491.aspx# Thanks in advance!

    Read the article

  • php custom forum error

    - by phillip morris
    i have a form, and i want to have it be limited at 10 characters minimum. that is no problem, but what i want to do is echo the error at the top of the page, which is being included, so i cant just do: echo '<div class="error">Error</div>'; i want to have a designated div that is empty (will be on the included header page), but when there is an error it gets filled with the error text to output. anyone know how to do this not using sessions or cookies?

    Read the article

  • Replay attacks for HTTPS requests

    - by MatthewMartin
    Let's say a security tester uses a proxy, say Fiddler, and records an HTTPS request using the administrator's credentials-- on replay of the entire request (including session and auth cookies) the security tester is able to succesfully (re)record transactions. The claim is that this is a sign of a CSRF vulnerability. What would a malicious user have to do to intercept the HTTPS request and replay it? It this a task for script kiddies, well funded military hacking teams or time-traveling-alien technology? Is it really so easy to record the SSL sessions of users and replay them before the tickets expire? No code in the application currently does anything interesting on HTTP GET, so AFAIK, tricking the admin into clicking a link or loading a image with a malicious URL isn't an issue.

    Read the article

  • How to catch HttpAntiForgeryException in ASP.NET MVC

    - by megalonychidae
    I'm using the AntiForgeryToken in my ASP.NET MVC forms. If I deactivate cookies in my browser and send the from, I'd get following error message: A required anti-forgery token was not supplied or was invalid. How can I prevent this message from showing? I would prefer redirecting the user to another page. I've activated customErrors and included this HandleError in my controller: [HandleError(ExceptionType=typeof(HttpAntiForgeryException), View="Index")] public class MyController : Controller { ... } The HandleError is ignored. Has anyone got a solution?

    Read the article

  • how to execute javascript in delphi?

    - by radick
    hi all i am coding a small app ,in middle i struck at some point where i have to execute javascript to get my data ? in my process ,i have to login to some url and then go to some page and have to get data from that . i done all this with indy idhttp ,i got all info except one column which needs javascript to get value ,then i itried to using twebbowser to make it work for me ,but how can i use cookies to enabled to webbrowser ? i navigated browserto('http://mysite.com/login.php user and pass ') ,well its loged in and then i tried to access next link like ('http://mysite.com/link1/example.php')but it directing to login page :( any help appreciated :)

    Read the article

  • Setting a Forms Authentication cookie from a .NET client application

    - by Jon DellOro
    We currently have a .NET 2.0 web app that uses forms authentication via cookies. Associated with this web app is an old VB6 client application that has its own login system. Currently, the users have to login to the VB6 app, and then when they click on a link, need to authenticate themselves again with the .NET forms authentication system. I'm wondering if it's possible to create a client side .NET application, give it the username and password, and set the forms authentication cookie (without the browser being opened). Is that possible??

    Read the article

  • PHP multiuser login class or script

    - by FFish
    I am looking for a simple but secure login script with mySQL PHP: sessions, MD5 that I can use with my exsisting database. Cookies to store password + password recovery by email. Change login/pass. I do not need registering, I register the user myself with temp login/pass. table agents agent1 agent2 table albums album1, owner: agent1 album2, owner: agent1 album3, owner: agent2 ... login.php agent1 logs in and has access to his albums: - album1 - album2 agent1 can edit his albums: edit.php?ref=album1 but NOT edit.php?ref=album3 by changing the ?ref variable

    Read the article

  • compile cs files with mono?

    - by acidzombie24
    I am trying to compile my project with mono on linux. My cmd looks something like... gmcs Pages/UserProfile.cs Properties/AssemblyInfo.cs queues.cs watch_editor.cs Class1.cs -define:USE_SQLITE -r:System -r:System.Collections -r:System.Collections.Generic -r:System.Collections.ObjectModel -r:System.Collections.Specialized -r:System.Configuration but much long. and i get the output error CS0006: cannot find metadata file `System.Collections' error CS0006: cannot find metadata file `System.Collections.Generic' error CS0006: cannot find metadata file `System.Collections.ObjectModel' ... How do i solve this? I also tried it the other way around (below) and had the same error msg with .dll at the end of them gmcs -define:USE_SQLITE -r:System.dll -r:System.Collections.dll -r:System.Web.UI.WebControls CommentCenter.cs cookies.cs db.cs Default.aspx.cs

    Read the article

  • Best Pratice to Implement Secure Remember Me

    - by Yan Cheng CHEOK
    Sometimes, I came across certain web development framework which doesn't provide authentication feature as in Authenication ASP.NET I was wondering what is the security measure needs to be considered, when implementing "Remember Me" login feature, by hand coding? Here are the things I usually did. 1) Store the user name in cookie. The user name are not encrypted. 2) Store a secret key in cookie. The secret key is generated using one way function based on user name. The server will verify secret key against user name, to ensure this user name is not being changed. 3) Use HttpOnly in cookie. http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html Any things else I could miss out, which could possible lead a security hole.

    Read the article

  • Why Shouldn't I Programmatically Submit Username/Password to Facebook/Twitter/Amazon/etc?

    - by viatropos
    I wish there was a central, fully customizable, open source, universal login system that allowed you to login and manage all of your online accounts (maybe there is?)... I just found RPXNow today after starting to build a Sinatra app to login to Google, Facebook, Twitter, Amazon, OpenID, and EventBrite, and it looks like it might save some time. But I keep wondering, not being an authentication guru, why couldn't I just have a sleek login page saying "Enter username and password, and check your login service", and then in the background either scrape the login page from say EventBrite and programmatically submit the form with Mechanize, or use an API if there was one? It would be so much cleaner and such a better user experience if they didn't have to go through popups and redirects and they could use any previously existing accounts. My question is: What are the reasons why I shouldn't do something like that? I don't know much about the serious details of cookies/sessions/security, so if you could be descriptive or point me to some helpful links that would be awesome. Thanks!

    Read the article

  • Why do I get a "Day too big" error from Perl?

    - by azp74
    I have been helping someone debug some code where the error message was "Day too big". I know that this springs from localtime and the Y2038 bug (most google results appear to be people dealing with cookies expiring well into the future). We appear to have 'fixed' the problem by using time to get the current date. However, given that none of our original dates should have hit the 2038 issue I'm sceptical that we've actually fixed the problem ... Are there other instances that anyone knows of where one would hit "day too big"? OS is Solaris. Sample code - the actual code is quite large and the person I'm working with hasn't actually isolated the offending part (which is why I'm worried the 'fix' is not actually a fix). If I can put together something concise which reproduces the issue I will post!

    Read the article

< Previous Page | 237 238 239 240 241 242 243 244 245 246 247 248  | Next Page >