online store - Page 409

Protecting Cookies: Once and For All

- by Your DisplayName here!

Every once in a while you run into a situation where you need to temporarily store data for a user in a web app. You typically have two options here – either store server-side or put the data into a cookie (if size permits). When you need web farm compatibility in addition – things become a little bit more complicated because the data needs to be available on all nodes. In my case I went for a cookie – but I had some requirements Cookie must be protected from eavesdropping (sent only over SSL) and client script Cookie must be encrypted and signed to be protected from tampering with Cookie might become bigger than 4KB – some sort of overflow mechanism would be nice I really didn’t want to implement another cookie protection mechanism – this feels wrong and btw can go wrong as well. WIF to the rescue. The session management feature already implements the above requirements but is built around de/serializing IClaimsPrincipals into cookies and back. But if you go one level deeper you will find the CookieHandler and CookieTransform classes which contain all the needed functionality. public class ProtectedCookie { private List<CookieTransform> _transforms; private ChunkedCookieHandler _handler = new ChunkedCookieHandler(); // DPAPI protection (single server) public ProtectedCookie() { _transforms = new List<CookieTransform> { new DeflateCookieTransform(), new ProtectedDataCookieTransform() }; } // RSA protection (load balanced) public ProtectedCookie(X509Certificate2 protectionCertificate) { _transforms = new List<CookieTransform> { new DeflateCookieTransform(), new RsaSignatureCookieTransform(protectionCertificate), new RsaEncryptionCookieTransform(protectionCertificate) }; } // custom transform pipeline public ProtectedCookie(List<CookieTransform> transforms) { _transforms = transforms; } public void Write(string name, string value, DateTime expirationTime) { byte[] encodedBytes = EncodeCookieValue(value); _handler.Write(encodedBytes, name, expirationTime); } public void Write(string name, string value, DateTime expirationTime, string domain, string path) { byte[] encodedBytes = EncodeCookieValue(value); _handler.Write(encodedBytes, name, path, domain, expirationTime, true, true, HttpContext.Current); } public string Read(string name) { var bytes = _handler.Read(name); if (bytes == null || bytes.Length == 0) { return null; } return DecodeCookieValue(bytes); } public void Delete(string name) { _handler.Delete(name); } protected virtual byte[] EncodeCookieValue(string value) { var bytes = Encoding.UTF8.GetBytes(value); byte[] buffer = bytes; foreach (var transform in _transforms) { buffer = transform.Encode(buffer); } return buffer; } protected virtual string DecodeCookieValue(byte[] bytes) { var buffer = bytes; for (int i = _transforms.Count; i > 0; i—) { buffer = _transforms[i - 1].Decode(buffer); } return Encoding.UTF8.GetString(buffer); } } HTH

Search Results

Search found 19994 results on 800 pages for 'online store'.

Page 409/800 | < Previous Page | 405 406 407 408 409 410 411 412 413 414 415 416 | Next Page >

- by Your DisplayName here!

- by Francisco Tirado

- by Richard Bingham

- by Janice J. Heiss

- by charlie.mott

- by Stefan Hinker

- by Jeff

- by Ghilliedrone

- by David Dorf

- by Tim Dexter

- by Tarun Arora

- by JaneZhang(???)

- by user47650

- by Josh

- by Sebsemillia

- by Reafidy

- by IrishChieftain

- by gregpakes

- by Adam

- by Michal

- by mickula

- by Adrian Grigore

- by AX1

- by matthewsteiner

- by Bjørn Øyvind Halvorsen

< Previous Page | 405 406 407 408 409 410 411 412 413 414 415 416 | Next Page >