authorization

How can I add the _locale parameter to security paths?

烈酒焚心 提交于 2019-12-04 05:08:14
I setup my security settings to protect everything which is under the root path / , exept for a public page to view the privacy policy, /privacy . Everything works fine. # security.yml access_control: - { path: ^/privacy$, role: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/, role: ROLE_USER } Now I added some different translations to the privacy policy page, so that the route changes from /privacy to /{_locale}/privacy . Unfortunately I cannot add the _locale parameter to the security path like this: access_control: ... - { path: ^/{_locale}/privacy$, role: IS_AUTHENTICATED_ANONYMOUSLY } So how

When does an iphone application receive didChangeAuthorizationStatus: delegate call?

有些话、适合烂在心里 提交于 2019-12-04 04:13:16
I have a question about CLLocationManagerDelegate . The documentation says if the user changes the settings for your location services (in the iPhone's Settings.app) then your app is supposed to receive an didChangeAuthorizationStatus: message to the delegate. My question is, when would this happen? If the user changed the setting, it means they are in the settings app, and your app is either backgrounded or not running at all, so in the former case, when would your app's CLLocationManager delegate get the didChangeAuthorizationStatus: call? I just ran across this method an hour ago, so good

ASP.NET WebAPI Basic Authentication always fails as 401/Unauthorized

梦想的初衷 提交于 2019-12-04 03:04:21
Trying to secure my ASP.NET Web API-2 using Basic Authentication but it is always ending up with error: 401/Unauthorized Authorization has been denied for this request. Below are my controller and ajax request code snippet alongside the request and response headers. BasicAuthenticationHandler.SendAsync always runs successfully up-till: return base.SendAsync(request, cancellationToken); Q: Then WHY it ends up as 401/unauthorized ? If I remove [Authorize] from the controller action then it works but without any security. Note: Because this is a cross-domain request so I have enabled CORS on

Authorization header doesn't get sent in cross-origin request

寵の児 提交于 2019-12-04 02:44:55
问题 Solution at the END. My server was my problem... Shortly solution, I need to use express cors Original POST: First of ALL: I have add Access-Control-Allow-Origin, Access-Control-Allow-Headers and i can access the server, but, i can't send data in the Header to the server. So: I am developing basically with Vue.js (with webpack to hot reload changes) and Express (with nodemon). So I have 2 separated servers: First: backend (server) running at: http://localhost:3000 with nodemon Second:

Rails 4 authorization gem [closed]

核能气质少年 提交于 2019-12-04 01:59:17
Closed. This question is off-topic. It is not currently accepting answers. Learn more . Want to improve this question? Update the question so it's on-topic for Stack Overflow. Closed 3 years ago . I am looking an authorization gem for rails 4. Before I used cancan, but it looks outdated nowadays... I found the_role here https://github.com/the-teacher/the_role It is nearly what I want, but has a few annoying issues. Maybe similar gems exist? I need roles, store roles in database and association actions with rules. It wound be great if gem cooperate with bootstrap. P.S. For authentication I use

PHP cURL Basic Authentication Alternatives for CURLOPT_HTTPHEADER & CURLOPT_USERPWD…?

こ雲淡風輕ζ 提交于 2019-12-04 01:09:40
问题 Are there any alternatives to using CURLOPT_HTTPHEADER & CURLOPT_USERPWD for supplying Basic Authentication for cURL PHP? I have a super long password, so CURLOPT_USERPWD wont work as it truncates at 256 characters. curl_setopt($data, CURLOPT_USERPWD, $username . ":" . $password); And I would like to stay away from using CURLOPT_HTTPHEADER for security reasons. curl_setopt($data, CURLOPT_HTTPHEADER, "Authorization: Basic " . base64_encode($username . ":" . $password)); Any alternatives? 回答1:

Rails cancan and State Machine - Authorizing states

可紊 提交于 2019-12-03 23:23:33
问题 I've been using the two awesome gems, state_machine and cancan recently in my rails application but I'm curious as to the best way to integrate them cleanly. Currently I've placed state transitions on buttons that go on actions authorized by the controller. This works perfectly, I can restrict who can perform that action. I would like to give the user the ability to change the objects state in the edit form as well. I've noticed that state_machine will pick up on the state_event key in the

AWS Authorization In Java

穿精又带淫゛_ 提交于 2019-12-03 21:58:06
In my Java application I want to create GET on a url which requires me to use an AWS Signature for authorization(AccessKey and SecretKey). Basically, I'm looking to do the equivalent of a GET in Postmanwhere the Authorization type is AWS Signature Is there any Java specific tutorial on how to do this? I came across this class on the net: public class AWSV4Auth { private final static Logger logger = LogManager.getLogger(AWSV4Auth.class); private AWSV4Auth() { } public static class Builder { private String accessKeyID; private String secretAccessKey; private String regionName; private String

CustomAuthorizationPolicy.Evaluate() method never fires in wcf webhttpbinding

守給你的承諾、 提交于 2019-12-03 20:45:03
问题 I create a wcf service as you can see : [OperationContract] [PrincipalPermission(SecurityAction.Demand, Role = "Admin")] [WebInvoke(Method = "GET", UriTemplate = "/Data/{data}")] string GetData(string data); So I create a custom authorize as you can see : public class AuthorizationPolicy : IAuthorizationPolicy { string id = Guid.NewGuid().ToString(); public string Id { get { return this.id; } } public System.IdentityModel.Claims.ClaimSet Issuer { get { return System.IdentityModel.Claims

Fetching custom Authorization header from incoming PHP request

北战南征 提交于 2019-12-03 18:32:31
问题 So I'm trying to parse an incoming request in PHP which has the following header set: Authorization: Custom Username Simple question: how on earth do I get my hands on it? If it was Authorization: Basic , I could get the username from $_SERVER["PHP_AUTH_USER"] . If it was X-Custom-Authorization: Username , I could get the username from $_SERVER["HTTP_X_CUSTOM_AUTHORIZATION"] . But neither of these are set by a custom Authorization, var_dump($_SERVER) reveals no mention of the header (in