authorization

How to intercept 401 from Forms Authentication in ASP.NET MVC?

由 夙愿已清 提交于 2019-12-03 02:11:24
I would like to generate a 401 page if the user does not have the right permission. The user requests a url and is redirected to the login page (I have deny all anonymous in web.config). The user logs in successfully and is redirected to the original url. However, upon permission check, it is determined that the user does not have the required permission, so I would like to generate a 401. But Forms Authentication always handles 401 and redirects the user to the login page. To me, this isn't correct. The user has already authenticated , the user just does not have the proper authorization . In

The proper way of implementing user login system

由 纵饮孤独 提交于 2019-12-03 02:02:07
I want to make a user login system for the purpose of learning. I have several questions. I did some research and found that the proper way of implementing a user login system is to store the user name/id and the encrypted/hashed version of the password in the database. When a user logs in, the password is encrypted client side (MD5, SHA-1 etc.) and sent to the server where it is compared with the one in database. If they match, the user log in successfully. This implementation prevents DBAs or programmers seeing the cleartext of the password in the database. It can also prevent hackers

ASP.NET MVC: Problem setting the Authorize attribute Role from a variable, requires const

由 為{幸葍}努か 提交于 2019-12-03 01:58:09
I am having a problem setting the Authorize attribute Role value from a variable. The error message says it requires a const variable. When I create a const type variable it works fine but I am trying to load the value from the Web.Config file or anything else that will allow the end user to set this. I'm using integrated Windows authentication since this is an intranet only application. Is there a way to check the users role from a controller? I will use this in an if statement to authenticate instead of an attribute. [Authorize(Roles = Config.GMPUser)] public ActionResult Index() { return

Stackoverflow's use of localstorage for Authorization seems unsafe. Is this correct else how do we strengthen it?

由 旧城冷巷雨未停 提交于 2019-12-03 01:57:50
问题 I have been working on a Authentication and authorization module similar to how stackexchange is in place. Now I am sure they use a certain model of oAuth or a token generation server that authorizes uses to their various sites. I tried a little experiment. Once I am logged into Stackoverflow, I delete all my cookies from the developer console. I leave my localstorage object intact which contains a key se:fkey xxxxxxxxxxxxxxxxxxxxxxxxx for stackoverflow domain. there is another key for

Authentication, Authorization, User and Role Management and general Security in .NET

由 风格不统一 提交于 2019-12-03 01:53:58
问题 I need to know how to go about implementing general security for a C# application. What options do I have in this regard? I would prefer to use an existing framework if it meets my needs - I don't want to re-invent the wheel. My requirements are as follows: the usual username/password authentication managing of users - assign permissions to users managing of roles - assign users to roles, assign permissions to roles authorization of users based on their username and role I am looking for a

Get specific attributes from an ActiveRecord model

由 有些话、适合烂在心里 提交于 2019-12-03 01:39:43
问题 Let's say that I have a User model with attributes :id, :first_name, :last_name, and :email . In my application, guest users shouldn't see User's email and last_name . I know how to select specific values if I want a list of users but I don't know how I can get specific attributes of a specific user like User.find_by(id: 5).select(:id, :first_name). One solution to that is to user User.find_by(id: 5).attributes.slice('id', 'first_name') but then I get a hash instead of an AR record. I could

Android: What is transport and jsonFactory in GoogleIdTokenVerifier.Builder?

由 試著忘記壹切 提交于 2019-12-03 01:21:54
in the blow code, whats is transport and jsonFactory ? (I do not understand) https://developers.google.com/identity/sign-in/android/backend-auth#using-a-google-api-client-library import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken; import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload; import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier; ... GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport /**Here**/, jsonFactory /**Here**/) .setAudience(Arrays.asList(CLIENT_ID)) // If you retrieved the token on Android using

basic authorization command for curl

由 会有一股神秘感。 提交于 2019-12-03 01:02:12
How do I set up the basic authorization using 64 encoded credentials ? I tried below the two commands but of no use , please suggest. curl -i -H 'Accept:application/json' Authorization:Basic <username:password> http://example.com curl -i -H 'Accept:application/json' Authorization:Basic.base64_encode(username:password) http://example.com Sabuj Hassan Use the -H header again before the Authorization:Basic things. So it will be curl -i \ -H 'Accept:application/json' \ -H 'Authorization:Basic username:password' \ http://example.com How do I set up the basic authorization? All you need to do is use

How can a JACC provider use the Principal-to-role mapping facilities of the server it's deployed on?

由 跟風遠走 提交于 2019-12-03 00:55:51
问题 I am writing a JACC provider. Along the way, this means implementing a PolicyConfiguration. The PolicyConfiguration is responsible for accepting configuration information from the application server, such as which permissions accrue to which roles. This is so that a Policy later on can make authorization decisions when handed information about the current user and what he's trying to do. However, it is not part of the PolicyConfiguration 's (atrocious) contract to maintain a mapping between

Secure documents with PHP

由 我是研究僧i 提交于 2019-12-03 00:51:25
I have a simple login / access control system to secure some restricted pages, but within these pages there are links that need to be secure, i.e. Word documents. Therefore if I keep these resources within the webroot they could accessible via a URL. What is the best method to secure these resources that are within the restricted page. I know I could password protect the folder but the user would then be challenged twice, one for the restricted page and then for the resource link. Any advice ? You have a few options here, depending on your use-case. Use PHP to serve the file. Basically, either
订阅 authorization