authorization | 易学教程

How to prevent CSRF in a RESTful application?

阅读更多关于 How to prevent CSRF in a RESTful application?

问题 Cross Site Request Forgery (CSRF) is typically prevent with one of the following methods: Check referer - RESTful but unreliable insert token into form and store the token in the server session - not really RESTful cryptic one time URIs - not RESTful for the same reason as tokens send password manually for this request (not the cached password used with HTTP auth) - RESTful but not convenient My idea is to use a user secret, a cryptic but static form id and JavaScript to generate tokens.

Finding authorization framework to be used on a ASP.NET MVC project

阅读更多关于 Finding authorization framework to be used on a ASP.NET MVC project

I have a asp.net mvc project and persistent is handled by repositories . Form authentication is used. Now I need implement authorization . For example , I need to ensure a manager user can only open his/her taskes and assign workers to the taskes. A worker will only see taskes that have been assigned to him/her. A super-moderator can edit everything. Is there any ready to use framework that allow me to define permissions ? I am in the process of evaluating Ayende Rhino Security . Where can I get more examples codes ? What is your opinion on Rhino Security ? My project use Linq to SQL and has

Identityserver4 and API in single project

阅读更多关于 Identityserver4 and API in single project

I have an IdentityServer4 asp.net-core host setup for Resource Owner Password Grant using JWT Bearer tokens and an API in a separate asp.net-core host which has my API and two Angular clients. The Authentication and Authorization is working from my two Angular clients to my API. Now I need to expose an API in the IdentityServer4 host so I can create users from one of the Angular clients. I have copied my Authentication and Authorization setup from my API over to my IdentityServer4 host, however, I cannot get it to Authenticate. In the below code, within the API, I can set a breakpoint on the

Hiding links from certain roles in ASP.NET MVC5

阅读更多关于 Hiding links from certain roles in ASP.NET MVC5

问题 So this may sound a dumb question, but how do I show a link only for an admin user? Suppose an ordinary user sees the following links: Home / About / Contact And an admin user sees the following links: Home / About / Contact / Admin I tried restricting in the controller and linking the controller on the menu. But it still shows the link for everyone, just doesn't allow access to anyone but admin Can the views be overloaded? 回答1: Depending on what sort of Membership/User provider you are using

Basic authentication in REST-application

阅读更多关于 Basic authentication in REST-application

问题 Environment: JAVA Glassfish REST-services in different machine HTML5-client with AJAX and JQuery Jersey This is what I have implemented so far: HTML5-client ### $('#btnSignIn').click(function () { var username = $("#username").val(); var password = $("#password").val(); function make_base_auth(user, password) { var tok = user + ':' + password; var final = "Basic " + $.base64.encode(tok); console.log("FINAL---->" + final); alert("FINAL---->" + final); return final; } $.ajax({ type: "GET",

Turn off firewall when developing in early stages with Symfony2?

阅读更多关于 Turn off firewall when developing in early stages with Symfony2?

Following this tutorial i'm developing a web application using symfony authentication/authorization architecture. After designing the whole structure (routes, pages and security levels) i'm stuck: how can i develop my pages without enter credentials all the time? Is there any way to disable or turn off the entire firewall functionality? Should i use data fixtures? In your app/config/security.yml file, under the firewalls config option add or modify the dev ... firewalls: dev: pattern: ^/ security: false The security.firewalls.dev: configuration is used in every Symfony environment (dev,test

Delphi DataSnap authorization not repecting TRoleAuth attribute

阅读更多关于 Delphi DataSnap authorization not repecting TRoleAuth attribute

I am trying to implement authorization in a Delphi XE DataSnap application. I broke this down into a very simple example, but still do not see the effects of the TRoleAuth attribute for a method or class. Here is a simple DSServerMethods class that includes the generated sample methods. The class has been decorated with the guest and anyone authorized roles, and the unwelcome denied role. The ReverseString method has been decorated with the readonly denied role: type [TRoleAuth('guest,anyone','unwelcome')] TMyDSServerMethods = class(TDSServerModule) DataSetProvider1: TDataSetProvider; ...

How do I use cancan to authorize an array of resources?

阅读更多关于 How do I use cancan to authorize an array of resources?

I have a non-restful controller that I am trying to use the cancan authorize! method to apply permissions to. I have a delete_multiple action that starts like so def delete_multiple @invoices = apparent_user.invoices.find(params[:invoice_ids]) I want to check that the user has permission to delete all of these invoices before proceeding. If I use authorize! :delete_multiple, @invoices permission is refused. My ability.rb includes the following if user.admin? can :manage, :all elsif user.approved_user? can [:read, :update, :destroy, :delete_multiple], Invoice, :user_id => user.id end Is it a

ASP.NET MVC Authorize user with many roles

阅读更多关于 ASP.NET MVC Authorize user with many roles

问题 I need to authorize a Controller in my ASP.NET MVC application to users which have two roles. I am using Authorize attribute like this: [Authorize(Roles = "Producer, Editor")] But this allows Producers and Editors to the controller. I want only to allow users having both roles, not just one of them. How could i achive this? 回答1: As the question states, when multiple roles are given in a single Authorize() call they are applied such that if the user belongs to any of the roles listed they will

RSpec Request - How to set http authorization header for all requests

阅读更多关于 RSpec Request - How to set http authorization header for all requests

问题 I'm using rspec request to test a JSON API that requires an api-key in the header of each request. I know I can do this: get "/v1/users/janedoe.json", {}, { 'HTTP_AUTHORIZATION'=>"Token token=\"mytoken\"" } But it is tedious to do that for each request. I've tried setting request.env in the before block, but I get the no method NilClass error since request doesn't exist. I need some way, maybe in the spec-helper , to globally get this header sent with all requests. 回答1: I don't think you