authorization

Using action parameters in custom Authorization Attribute in ASP.NET MVC3

由 我们两清 提交于 2019-11-27 11:47:49
问题 I have a controller which should only request authorization when loaded with specific parameters. Like when the parameter ID is 8 for example. I came up with using a custom validation attribute like this: public class MyAuthorizeAttribute : AuthorizeAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { if (/* Action's inputparameter ID = 8 */) { return base.AuthorizeCore(httpContext); } return true; } } My action looks like this (not that it is interesting)

Python requests library how to pass Authorization header with single token

由 ℡╲_俬逩灬. 提交于 2019-11-27 11:45:27
I have a request URI and a token. If I use: curl -s "<MY_URI>" -H "Authorization: TOK:<MY_TOKEN>" etc., I get a 200 and view the corresponding JSON data. So, I installed requests and when I attempt to access this resource I get a 403 probably because I do not know the correct syntax to pass that token. Can anyone help me figure it out? This is what I have: import sys,socket import requests r = requests.get('<MY_URI>','<MY_TOKEN>') r. status_code I already tried: r = requests.get('<MY_URI>',auth=('<MY_TOKEN>')) r = requests.get('<MY_URI>',auth=('TOK','<MY_TOKEN>')) r = requests.get('<MY_URI>'

Overriding AuthorizeCore in custom Authorize attribute results in “no suitable method found to override” error

由 筅森魡賤 提交于 2019-11-27 11:44:57
问题 I'm trying to build custom AuthorizeAttribute, so in my Core project (a class library) I have this code: using System; using System.Web; using System.Web.Mvc; using IVC.Core.Web; using System.Linq; namespace IVC.Core.Attributes { public class TimeShareAuthorizeAttribute : AuthorizeAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { if(!httpContext.Request.IsAuthenticated) return false; var rolesProvider = System.Web.Security.Roles.Providers["TimeShareRoleProvider"

How do I unit test a controller method that has the [Authorize] attribute applied?

由 醉酒当歌 提交于 2019-11-27 11:08:14
I've searched stackoverflow and googled four a couple of hours and still not found any solution for my "trivial" problem. If you write unit test for your filtered [Authorize] ActionResult , how do you solve the problem to fake that user is authenticated? I have a lot of ActionResult methods that are filtered with [Authorize] and I want to test all of my ActionResult methods regardless if they are filtered with [Authorize] or not. A simple example of what i mean: [TestMethod] public void Create_Get_ReturnsView() { // Arrange var controller = new UserController(); // Act var result = controller

Authorization header missing in PHP POST request

由 蹲街弑〆低调 提交于 2019-11-27 11:05:56
问题 I'm currently trying to read the authorization header in a PHP script that I'm calling with a POST request. The Authorization header is populated with a token. It seems the Authorization header is somehow removed before it arrives at my PHP script. I'm executing the post request with Postman (Chrome addon) and I enabled CORS in my PHP script. I don't have access to the apache server directly. HTTP Request: Accept:*/* Accept-Encoding:gzip,deflate Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q

Pyramid authorization for stored items

由 ◇◆丶佛笑我妖孽 提交于 2019-11-27 10:57:26
问题 I'm trying to create an authorization policy that takes "item" ownership into account. For example some user X "owns" items A, B, C. Those are accessed via URLs like /item/{item}/some_options . How can I get the information about {item} to the authorization policy object (permits() call)? Is putting additional information into context a good idea (I'm doing routes-based routing only). How would I do that? 回答1: You can do this using the ACLAuthorizationPolicy combined with URL Dispatch by

Should I be using an IAuthorizationFilter if I wish to create an ApiKey restricted resource with ASP.NET MVC4?

由 梦想的初衷 提交于 2019-11-27 10:48:57
问题 I have a few simple routes which I wish to restrict via a simple querystring param. If the key is incorrect or not provided, then I wish to throw a NotAuthorizedException . Please don't suggest I use WebApi or the equiv - I can't just yet in this scenario. So i'm not sure if I should be implementing an IAuthorizationFilter or implementing an IActionFilter or even something else. My code logic? Check querystring for key. Check my RavenDb (repository) for a user with that key/value. If they

HttpClient single instance with different authentication headers

由 冷暖自知 提交于 2019-11-27 10:43:44
Given that the .net HttpClient has been designed with reuse in mind and is intended to be long lived and memory leaks have been reported in short lived instances. What guide lines are there where you want to make restful calls to a given endpoint using different bearer tokens (or any authorization header) when calling the endpoint for multiple users? private void CallEndpoint(string resourceId, string bearerToken) { httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", bearerToken); var response = await httpClient.GetAsync($"resource/{resourceid}"); } Given

Can't connect Nexus 4 to adb: unauthorized

由 二次信任 提交于 2019-11-27 10:37:47
I have a Nexus 4 with Android 4.3 and I am trying to connect the device to a computer with Windows 7 64bit. I installed the latest drivers and the latest adb version. I think I tried almost everything and I still get the following message: C:\Program Files (x86)\Android\sdk\platform-tools>adb devices List of devices attached 007667324ccb229b unauthorized What can be the reason for this error? I had similar situation. Here is what I did: Try to check and uncheck the USB Debugging option in the device. (if not working, try to unplug/plug the USB) At some point, the device should show up a

MVC Custom Authentication, Authorization, and Roles Implementation

由 一世执手 提交于 2019-11-27 10:11:17
问题 Bear with me as I provide details for the issue... I've got an MVC site, using FormsAuthentication and custom service classes for Authentication, Authorization, Roles/Membership, etc. Authentication There are three ways to sign-on: (1) Email + Alias , (2) OpenID , and (3) Username + Password . All three get the user an auth cookie and start a session. The first two are used by visitors (session only) and the third for authors/admin with db accounts. public class BaseFormsAuthenticationService
订阅 authorization