authorization | 易学教程

How to conditionally display elements of JSP page depending on user role

阅读更多关于 How to conditionally display elements of JSP page depending on user role

问题 How to load menu on webpage depends upon login user? I want to make websites where some menu will show before login and after login it will show more menu depends upon login user if admin is login then some administraive menu will appear if normal user is login then some different menu will be added. I want to build this project using JSP/Servlet. When user click on any menu total page will not be reloaded only some part will be changed where show the details description of this menu. 回答1:

asp.net mvc [Authorize()] attribute for mixed group and user

阅读更多关于 asp.net mvc [Authorize()] attribute for mixed group and user

问题 I am using ASP.NET MVC 1.1 with Windows authentication. I trying to only authorize members of a group and myself. I am not a member of the group and would not need to be a member of this group. I am getting windows login/password prompt every time I access the URL of the web app. The HomeController has [HandleError] [Authorize(Roles=@"MyDomain\\company.security.group.name")] [Authorize(Users=@"MyDoamin\\MyName")] [OutputCache(Duration=86400,VaryByParam="PageIndex")] public class

Dynamically add roles to authorize attribute for controller in ASP.NET 5

阅读更多关于 Dynamically add roles to authorize attribute for controller in ASP.NET 5

问题 I have a sample question with this post Dynamically add roles to authorize attribute for controller but for ASP.NET 5 (vNext) In ASP.NET 5, I can not overwrite AuthorizeAttribute class as above post said. So how can I add roles dynamically Controllers in ASP.NET 5 (vNext) Thanks in advance. 回答1: As mike mentioned, you need policies. Here is one implementation. public class CustomRoleRequirement : AuthorizationHandler<CustomRoleRequirement>, IAuthorizationRequirement { protected override void

Which HTTP status code to say username or password were incorrect?

阅读更多关于 Which HTTP status code to say username or password were incorrect?

问题 I am implementing a simple registation/login module. While testing user credentials, I start thinking which HTTP status code will be appropriate, for the situation if a user send a request with incorrect credentials. At first, I thought 401 Unauthorized would be a nice status code, but it seems it will be better to use it when a user is trying to get some resource without authorisation. After, I switched to 409 Conflict This code is only allowed in situations where it is expected that the

How to remove the redirect from an ASP.NET Core webapi and return HTTP 401?

阅读更多关于 How to remove the redirect from an ASP.NET Core webapi and return HTTP 401?

问题 Following the answer on this question, I have added authorization on everything by default, using the following code: public void ConfigureServices(IServiceCollection aServices) { aServices.AddMvc(options => { var lBuilder = new AuthorizationPolicyBuilder().RequireAuthenticatedUser(); var lFilter = new AuthorizeFilter(lBuilder.Build()); options.Filters.Add(lFilter); }); aServices.AddMvc(); } public void Configure(IApplicationBuilder aApp, IHostingEnvironment aEnv, ILoggerFactory

FormsAuthentication.SetAuthCookie doesn't [Authorize] in MVC 5

阅读更多关于 FormsAuthentication.SetAuthCookie doesn't [Authorize] in MVC 5

问题 I created a brand new ASP.NET MVC 5 project to test the [Authorize] attribute with FormsAuthentication.SetAuthCookie . I simply set a cookie in one action (in my Home controller): public ActionResult About() { FormsAuthentication.SetAuthCookie("someUser", false); And I limit access to another: [Authorize] public ActionResult Contact() { When I launch my web page and navigate to /home/contact , I am correctly redirected to a login page. Then I go to /home/about , get my cookie, and go back to

Keeping track of logged-in users

阅读更多关于 Keeping track of logged-in users

I'm creating an ASP.NET MVC application. Due to the complex authorization, I'm trying to build my own login system. I'm not using ASP.NET membership providers, and related classes) I'm able to create new accounts in the database with hashed passwords. How do I keep track that a user is logged in? Is generating a long random number and putting this with the userID in the database and cookie enough? After validating the user credentials you can have a code like: public void SignIn(string userName, bool createPersistentCookie) { int timeout = createPersistentCookie ? 43200 : 30; //43200 = 1 month

How to check if user is authorized inside Action

阅读更多关于 How to check if user is authorized inside Action

Usually I protect my Actions with [Authorize] but this time I need to check if a user is authorized inside the action. Eg if(userIsAuthorized) { //do stuff } else { //return to login page } I believe I am using 'Forms Authentication' This question is kind of similar to this but none of the answers given seemed to work. EDIT: I have done some more digging- it seems if I breakpoint on an Action that has [Authorize] , the User.Identity is set, but on Actions without it, the User.Identity is empty, even if I am logged in If you just want to know if the user is logged in: if (User.Identity

Force ask authorization onOpen() (force popup)

阅读更多关于 Force ask authorization onOpen() (force popup)

SUMMARY: Is it possible to ask for authorization onOpen()? DETAILED VERSION: I have a spreadsheet with buttons that gets distributed to a lot of people. When any button is pressed, some functions that require permissions are called, so Google Apps Script shows this popup: AFTER this is accepted, everything runs well, since it has authorization now. However, I want to run things that require permissions BEFORE a button is pushed, when the Workbook is opened. However, if you place authorization-requiring code into an onEdit or onOpen function, it runs with no privileges by default and crashes

Implement a Tomcat Realm with LDAP authentication and JDBC authorization

阅读更多关于 Implement a Tomcat Realm with LDAP authentication and JDBC authorization

问题 I'm working in a legacy environment where an LDAP server is used only for authentication and contains no roles, and authorization is done against a database which contains the user-role mapping, but no passwords. My plan is to implement a new Tomcat Realm by extending JNDIRealm, and overriding the role methods to call an encapsulated JDBCRealm. My realm is declared in server.xml: <Realm className="com.example.LdapJdbcRealm" connectionURL="ldap://ldaphost:389" resourceName="LDAP Auth"