javascript - ASP.NET Forms Authentication with per session/page API token -


let me first start saying realize similar many other questions service access control can't seem find 1 response relevant on of points below, asking (possibly) again.

some background: building web application .net protected custom forms authentication implementation. same app (within same domain) needs leverage several rest services related data management within javascript/jquery many of app's functions not suited post use in forms.

i trying determine secure way implement access control rest service based on authentication done server side when app first accessed.

here example use case describing:

  1. user logs asp.net site using forms authentication , upon successful authentication user taken landing page of application
  2. the user chooses access page @ ~/users.aspx link on landing page, forms auth allows based on cookie created authentication in step 1
  3. users.aspx loads basic html elements, empty table , hidden field contains token (guid) generated @ page load. token in hidden field used javascript access rest service retrieves data populate table. token stored in database pre-defined expiration.
  4. when rest service called token checked expiration , used determine user making call , provide authorization data being accessed database, if user authorized access/update data service performs requested service operation, extends expiration on token, , returns response.

i know token visible sniffing request/response on network unless ssl used encrypt transmission, ssl used counter this.

my question is:

  1. are there other attacks service vulnerable to?
  2. is there better way handle authorization , user identification rest service based on server side login other statically assigned token service? seems me statically assigned user token less secure since give endless access service if obtained malicious user.
  3. assuming answer #2 no, there better way transmit token client , store there life of page use knowing needs accessible javascript/jquery?


Comments

Post a Comment

Popular posts from this blog

php - cannot display multiple markers in google maps v3 from traceroute result -

i'm newbie in php mysql , google maps v3. have problems in google maps v3. made traceroute web based , map traceroute's result in google maps v3 final project of college education. have try many tutorials didn't work. have tried tutorials in forum nothing worked. problem cannot display multiple markers got location data database. maybe because i'm newbie , not know how do. confuse looping show markers. here code <?php error_reporting(e_all ^ (e_notice)); ini_set('max_execution_time', 360); $enable_log_user = false; global $ip, $host_name, $host_ip; $host = @$_post['host']; $trace = @$_post['trace']; $self = $_server['php_self']; include("phpsqlajax_dbinfo.php"); $connection = mysql_connect ('127.0.0.1', $username, $password); if (!$connection) { die('not connected : ' . mysql_error());} $db_selected = mysql_select_db($database, $connection); if (!$db_selected) { die ('can\'t use db :
Read more

c# - DetailsView in ASP.Net - How to add another column on the side/add a control in each row? -

i have detailsview control on page used edit various fields of record, works in respect. i looking way add 1 column (and if works, why not more) right, absolutely read-only, show same fields of record comparison purposes. i aware there no obvious way such thing out of box detailsview . have looked other controls (transposed gridview , recommended formview , listview ), nothing satisfies. have special data binding setup using detailsview , can't out of without losing features. anyone on how "hack in" additional columns (for display only) on detailsview ? the solution have now, use second detailsview , visible set false in aspx. in code, make sure databind hidden detailsview hosts data third column first, initial detailsview named itemdetails . and in item created event, pass third column html rendering of hidden controls (in last code block) : protected void itemdetails_itemcreated(object sender, eventargs e) { if (dataite
Read more

javascript - firefox memory leak -

i have following script (i use raphaeljs also) draws circle, waits 1 second, draws circle again, etc (you can copy paste - functional, need include raphael raphaeljs.com): <div id="holder"> </div> <script src="raphael.js" type="text/javascript"></script> <script> var paper = raphael(10, 50, 320, 200); var rad = math.pi / 180; var finangle = 0; function sector(cx, cy, r, startangle, endangle, params) { var x1 = cx + r * math.cos(-startangle * rad), x2 = cx + r * math.cos(-endangle * rad), y1 = cy + r * math.sin(-startangle * rad), y2 = cy + r * math.sin(-endangle * rad); return ["m", cx, cy, "l", x1, y1, "a", r, r, 0, +(endangle - startangle > 180), 0, x2, y2]; } var path = sector(100,100,50,0,180); var arc = paper.path(path); function draw() { path = sector(100,100,50,0,finangle);
Read more