security

IdentityServer4 - Refresh Tokens Hybrid Flow - Cookies and storage

由 故事扮演 提交于 2020-02-07 02:28:45
问题 I've followed Quickstart Hybrid Flow here but I need some help and advices about saving tokens after using refresh token. If I say true, the option SaveTokens allows to save tokens in cookies. Firstly, is it a good idea to store access and refresh tokens in a cookie (concerns about security) ? Other question, I retrieve correctly refresh token via the code var refreshToken = await HttpContext.GetTokenAsync("refresh_token"); but now, when I get the new access token, how can I store it (no

Basic Working Example of an XXE Attack in HTML part 2

由 眉间皱痕 提交于 2020-02-07 02:00:26
问题 Follow up to this: Basic Working Example of an XXE Attack in HTML seemed easier to make this follow up than to try and shoehorn my progress into the previous question. I thought better to allow the correct answer to that query to appear correct plain and simple. I have now evolved my example to the following: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <p id="xmlOut"></p> <script type="application/javascript"> var xml = ` <!DOCTYPE foo [

Restrict Access in WCF using FormsAuthenticationTicket, or other method?

由 ￡可爱￡侵袭症＋ 提交于 2020-02-06 02:15:54
问题 I've seen solutions where you can restrict access in WCF using the membership in asp.net.(How do I restrict access to some methods in WCF?) But i'm wondering if there is anything similar using the FormsAuthenticationTicket. I don't have the Membership configured on my site, and i'm using the FormsAuthenticationTicket and methods in WCF to log in and so on. The WCF-Service is not configured to use SSL YET, because the man i work for have not bought a cert trough our hosting company(don't know

Symfony security.password_encoder isPasswordValid is returning empty

由 孤者浪人 提交于 2020-02-05 02:51:09
问题 In Symfony 2.6, I am using the following method to encode my password. The password is successfully encoded and saved in the DB. $encoder = $this->container->get('security.password_encoder'); $encodedPwd = $encoder->encodePassword($adminUser, $plainPassword); When I try to validate the user supplied password provided in the login form as follows: $adminUser = $this->getDoctrine()->getManager()->getRepository("AcmeUserBundle:AdminUser")->findOneBy(array('username' => $_username)); $_password =

How to use the OpenID Connect WebFinger Endpoint?

由 故事扮演 提交于 2020-02-03 13:33:19
问题 Reading the description here it says: WebFinger — Enables dynamic discovery of the OpenID Connect provider for a given user, based on their email address or some other information. Can someone give an example of how this works (Description is somewhat abstract)? 回答1: WebFinger is a protocol defined in RFC7033. There is a complete example in section 3.1: 3.1. Identity Provider Discovery for OpenID Connect Suppose Carol wishes to authenticate with a web site she visits using OpenID Connect. She

Which method is more secure between MySQLi and PDO [closed]

由 爷，独闯天下 提交于 2020-02-03 11:07:09
问题 As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. Closed 6 years ago . So far, I'm seeing that both MySQLi and PDO are good methods when connecting to the database. What I need is which method is more

How to prevent piracy for java webstart application

由 末鹿安然 提交于 2020-02-03 05:29:27
问题 I have this java swing application that I intend to sell over the internet. At the moment I'm leaning towards deploying the application using java webstart. The product will be licensed for the user to use the program on one computer at a time only. I am concerned about piracy with this model. I would like to install some security features to enforce the license model. The goal is to at least make it difficult for a licensed user to copy the installed product including license key to

AWS Cognito and CORS Security Concern

由 六月ゝ 毕业季﹏ 提交于 2020-02-03 02:11:34
问题 I have a web client making requests to AWS Lambda via the AWS API Gateway. I'm using AWS Cognito, alongside Auth0, to authenticate users. My question is related to the CORS response headers from the AWS API Gateway endpoint, specifically the Access-Control-Allow-Origin response header that is set to any "' * '". This article indicates the risks of using the any "' * '" parameter, namely that a 'hacker can coopt our site to request any method' on our back-end: (CORS Security link). While

How to test asp.net location folder authorization programmatically

由 安稳与你 提交于 2020-02-02 13:59:43
问题 I have an location element in my web.config like so: <location path="Admin"> <system.web> <authorization> <allow roles="Domain\Development"/> <deny users="*" /> </authorization> </system.web> </location> This works to only allow members of the development group access to this folder. I was wondering if there is a way to simply test if a user has access to this folder? One scenario is creating menu items. I'd simply like to hide or not render links to pages in this folder if the user does not

How to test asp.net location folder authorization programmatically

由 非 Y 不嫁゛ 提交于 2020-02-02 13:57:33
问题 I have an location element in my web.config like so: <location path="Admin"> <system.web> <authorization> <allow roles="Domain\Development"/> <deny users="*" /> </authorization> </system.web> </location> This works to only allow members of the development group access to this folder. I was wondering if there is a way to simply test if a user has access to this folder? One scenario is creating menu items. I'd simply like to hide or not render links to pages in this folder if the user does not
订阅 security