Arun Manglick - Technical View: Search results for validation key

Showing posts sorted by relevance for query validation key. Sort by date Show all posts

Wednesday, May 16, 2007

DecryptionKey & ValidationKey

By default, you cannot share the same Authentication Ticket cookie across multiple servers [Web farm] or multiple application on the same Web Server.

· By default, the Forms authentication cookie is encrypted and signed.

· By default, each application generates a unique decryption and validation key.

· Therefore, by default, you can't share the same authentication cookie across applications neither in the same Web Server nor different Web Servers.

Here are the default settings for this element:

<machineKey

decryption="Auto"

validation="SHA1"

decryptionKey="AutoGenerate, IsolateApps"

validationKey="AutoGenerate, IsolateApps" />

To share the same authentication cookie across every application hosted on the same web server, do as below.

· Remove the IsolateApps attribute, as it cause to generate a different keys for every application.

<machineKey

decryption="Auto"

validation="SHA1"

decryptionKey="AutoGenerate"

validationKey="AutoGenerate" />

To share the same authentication cookie across separate web servers.

· Then you need to specify the decryptionKey and validationKey manually.

<machineKey

decryption="AES"

validation="SHA1"

decryptionKey="306C1FA852AB3B0115150DD8BA30821CDFD125538A0C606DACA53DBB3C3E0AD2"

validationKey="61A8E04A146AFFAB81B6AD19654F99EA7370807F18F5002725DAB98B8EFD19C711337E269

48E26D1D174B159973EA0BE8CC9CAA6AAF513BF84E44B2247792265" />

Thanks & Regards,

Arun Manglick

SMTS || Microsoft Technology Practice || Bridgestone - Tyre Link || Persistent Systems || 3023-6258

DISCLAIMER ========== This e-mail may contain privileged and confidential information which is the property of Persistent Systems Pvt. Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Pvt. Ltd. does not accept any liability for virus infected mails.

Friday, January 18, 2008

DefaultButton and DefaultFocus in Master-Content Page

Default Focus, Buttons and Validation Errors with ASP.NET 2.0

One of the common requests with ASP.NET 1.1 today is to have better control over what happens when a user in a browser hits the enter key without having a button or post-back control selected.

ASP.NET 2.0 makes this easier by supporting the concept of a "default button" that can be indicated on either a <form> or <asp:panel> container control. If no button is selected at the time the enter key is selected, the defaultbutton property will drive the appropriate post-back to the server and route the message to the control you want.

<asp:textbox id=“textbox1” runat=“server”/>
<asp:textbox id=“textbox2” runat=“server”/>

<asp:button id=“button1” text=“Same Page” runat=“server”/>

<asp:panel defaultbutton=“button2” runat=“server”>

<asp:textbox id=“foo” runat=“server”/>

<asp:button id=“button2” runat=“server”/>

</asp:panel>

</form>
</body>
</html>

· Here if the enter key is selected the first time the page is loaded, "button1" will be the button that receives the post-back event.

· If the enter key is hit while the user has their cursor focus within the "foo" textbox (contained wtihin the <asp:panel>), then "button2" will be the button that receives the post-back event.

There is a catch in this feature, when the page is using Master Page. In this case, below would be required to handle the situation.

protected void Page_Load(object sender, EventArgs e)

{

Page.Form.DefaultButton = Button2.UniqueID;

}

protected void Page_PreRender(object sender, EventArgs e)

{

Page.SetFocus(TextBox2);

}

Thanks & Regards,

Arun Manglick || Tech Lead

Wednesday, January 27, 2010

DecryptionKey & ValidationKey - Generation

Hi,

I discussed once (May 2007) sharing keys while using ‘Forms Authentication Across Applications’

The discussion was about sharing the same authentication keys Across Applications Located On The Same Or Different Web Servers in the same domain.

In the topic we discussed when need to share the same authentication cookie across separate web servers, then you need to specify the decryptionKey and validationKey manually.

You cannot allow the ASP.NET Framework to generate these keys automatically because you need to share the keys across the different web servers.

<machineKey

  decryption="AES"

  validation="SHA1"

  decryptionKey="306C1FA852AB3B0115150DD8BA30821CDFD125538A0C606DACA53DBB3C3E0AD2"

  validationKey="61A8E04A146AFFAB81B6AD19654F99EA7370807F18F5002725DAB98B8EFD19C711337E269.... " />

You can use the below code to generate these random character sequences for you.

Note:

When using AES, you need to set the decryption key to a random sequence of 64 hex characters.

When using SHA1, you need to set the decryption key to a random sequence of 128 hex characters.

using System;

using System.Text;

using System.Security;

using System.Security.Cryptography;

class App {

static void GetSequence(string argv, int len)

{

byte[] buff = new byte[len/2];

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();

rng.GetBytes(buff);

StringBuilder sb = new StringBuilder(len);

for (int i=0; i<buff.Length; i++)

sb.Append(string.Format("{0:X2}", buff[i]));

Console.WriteLine(sb);

}

The above code sample is based from an article entitled "How To: Configure MachineKey in ASP.NET 2.0," located at the Microsoft MSDN website (msdn.microsoft.com).

Hope this helps.

Regards,

Arun Manglick

Disclaimer: The information contained in this message may be privileged, confidential, and protected from disclosure. If you are not the intended recipient, or an employee, or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer.

Tuesday, April 29, 2008

LINQ Overview

Hi,

This blog post summarizes the overview of LINQ.

Below are the new features been introduced in Orcas

§ Automatic Properties

§ Object Initializers

§ Collection Initializers

§ Extesnion Methods

§ Lambda Expressions - p => expressions

§ Query Syntax

§ Anonymous Types

§ Var Keyword

These language features help in making query against relational data. This overall querying programming model is called as "LINQ" - which stands for .NET Language Integrated Query.

LINQ Features list:

· LINQ can be used with any data source.

· LINQ can express efficient query behavior in many programming language of choice.

· LINQ can optionally Transform/Shape data query results into whatever format you want, and then easily manipulate the results.

· LINQ-enabled languages can provide Full Type-Safety And Compile-Time Checking of query expressions.

· LINQ-enabled development tools can provide full intellisense, debugging, and rich refactoring support when writing LINQ code.

· LINQ supports a very rich extensibility model that facilitates the creation of very efficient domain-specific operators for data sources.

· The "Orcas" version of the .NET Framework ships with built-in libraries that enable LINQ support against Objects, XML, and Databases.

LINQ to SQL

· It is an O/RM (object relational mapping) implementation that ships in the .NET Framework "Orcas" release, and allows us to MODEL A RELATIONAL DATABASE USING .NET CLASSES.

· These classes are typically referred to as "Entity Classes" and instances of them are called "Entities". Entity classes map to tables within a database. The properties of entity classes typically map to the table's columns. Each instance of an entity class then represents a row within the database table.

· We can then query/ update/insert/delete the database using LINQ.

· It fully supports transactions, views, and stored procedures.

· It also provides an easy way to integrate data validation and business logic rules into your data model.

· "Orcas" ships with a LINQ to SQL designer (.dbml) that provides an easy way to model and visualize a database as a LINQ to SQL object model.

· This designer has two parts. The Let Part (Broader one) contains Tables and the right part (Narrow one) contains SP, Functions.

DataContext Class

· For each LINQ to SQL designer file added to our solution, a custom DataContext class will also be generated.

· This DataContext class is the main conduit by which the entities (Entity Classes) from the DB are queried and as well as apply changes.

· The DataContext class created will have properties that represent each Table we modeled within the database, as well as methods for each Stored Procedure we added.

Entity Classes

· Do not have to derive from a specific base class.

· All classes created using the LINQ to SQL designer are defined as "partial classes" - which means that you can optionally drop into code and add additional properties, methods and events to them.

· Unlike the DataSet/TableAdapter feature provided in VS 2005, when using the LINQ to SQL designer you do not have to specify the SQL queries to use when creating your data model and access layer. Instead, you focus on defining your entity classes, how they map to/from the database, and the relationships between them. The LINQ to SQL OR/M implementation will then take care of generating the appropriate SQL execution logic for you at runtime when you interact and use the data entities. You can use LINQ query syntax to expressively indicate how to query your data model in a strongly typed way.

Naming and Pluralization

· To notice LINQ to SQL designer automatically "pluralizes" the various table and column names when it creates entity classes based on your database schema.

· i.e. The "Products" table resulted in a "Product" class, and the "Categories" table resulted in a "Category" class. This class naming helps make our models consistent with the .NET naming conventions.

· We can change the name of a class or property that the designer generates. This ability to have entity/property/association names be different from your database schema ends up being Very Useful in a number of cases. In particular:

· When your backend database table/column schema names change. Because your entity models can have different names from the backend schema, you can decide to just update your mapping rules and not update your application or query code to use the new table/column name.

· When you have database schema names that aren't very "clean". For example, rather than use "au_lname" and "au_fname" for the property names on an entity class, you can just name them to "LastName" and "FirstName" on your entity class and develop against that instead (without having to rename the column names in the database).

Relationship Associations

· When you drag objects from the server explorer onto the LINQ to SQL designer, Visual Studio will inspect the primary key/foreign key relationships of the objects, and based on them Automatically Create default "relationship associations" between the different entity classes it creates.

· If you don't like how the designer has modeled or named an association, you can always override it. Just click on the association arrow within the designer and access its properties via the property grid to rename, delete or modify it.

Reference:

http://weblogs.asp.net/scottgu/archive/2007/05/19/using-linq-to-sql-part-1.aspx

http://weblogs.asp.net/scottgu/archive/2007/05/29/linq-to-sql-part-2-defining-our-data-model-classes.aspx

Hope this helps.

Thanks & Regards,

Arun Manglick || Tech Lead

Monday, May 12, 2014

Web Application Security & Non-Hacking Tools & Techniques

Below are major threat categories. We'll study here different tools and techniques to prevent such attacks.

Cross Site Scripting(XSS) & HTML Injection
Cross site request Forgeries(CSRF)
Session Hijacking
Injection

SQL Injection
HTML Injection
HTTP header injection
Mail-header injection
OS command injection

Sensitive Data Handling
Phishing Attack
Click-Jacking
Directory Traversal
Race Condition
Access Control
Encryption
Programming
Input Validation

Security Vulnerability Tools:

Ref: https://phoenixnap.com/blog/vulnerability-assessment-scanning-tools
Few :

W3AF - Web Application Attack Framework - Free and open-source vulnerability scanning tool for web applications. It creates a framework which helps to secure the web application by finding and exploiting the vulnerabilities. Also has exploitation facilities used for penetration testing work as well.
Acunetix - Paid web application security scanner (open-source version also available) with many functionalities provided. Around 6500 vulnerabilities scanning range is available with this tool. In addition to web applications, it can also find vulnerabilities in the network as well. Provides ability to automate your scan. HSBC, NASA, USA Air force are few industrial giants who use this for vulnerability tests.
Intruder - Paid vulnerability scanner specifically designed to scan cloud-based storage. Intruder software starts to scan immediately after a vulnerability is released. The scanning mechanism in Intruder is automated and constantly monitors for vulnerabilities. Also identify network vulnerabilities as well as provide quality reporting and suggestions.

1). Cross Site Scripting(XSS):

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
An attacker can use XSS to send a malicious script to an unsuspecting user.
The end user’s browser has no way to know that the script should not be trusted, and will execute the script.
The malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
These scripts can even rewrite the content of the HTML page.

Cross-site scripting (XSS) vulnerabilities occur when:

Untrusted data enters a web application, typically from a web request.
The web application dynamically generates a web page that contains this untrusted data.
During page generation, the application does not prevent the data from containing ontent that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.
A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.
Three Types of XSS:

Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response.
Type 2: Stored XSS (or Persistent) - The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content.
Type 0: DOM-Based XSS - In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection.

Security Solution:

No HTML tag should be allowed as input data

ASP.NET Razor Views are HTML Encoded by default (also ASP.NET MVC 4)
For aggressive stripping use Microsoft AntiXSS library
Use HTML.Encode <%: %> provided by ASP.Net MVC for output

All inputs should be HTML escaped

Prevent HTML tags in inputs by default, globally. (To turn it off - ValidateInput=false / AllowHTML) (ASP.NET MVC 4)
Use Microsoft Anti-Cross Site Scripting Library (AntiXSS) and set it as default HTML encoder.
Use AntiXSS Sanitizer object to call GetSafeHtml or GetSafeHtmlFragment before saving HTML data to the database

All attributes should be put in double quote parentheses

Ensure no Script tag is included in the input value
Specify the charset to Content Type on HTTP response header

Modify web.config code on IIS with following to specify charset and content-type as (name="Content-Type" value="text/html; charset='UTF-8'" )

Use HttpOnly attribute to the cookie
Use of AllowHtml Attribute in MVC
Encode HTML Tags -

Encode the string input using HtmlEncode method.
Write a Regular Expression to replace HTML tags by replacing its encode character

Enable ASP.NET request validation - Either ValidateRequest="true"or remove the ValidateRequest page attribute

2). Cross site request Forgeries(CSRF):

CSRF vulnerabilities occur when:

When attacker tricks the victim into submitting a malicious request by inheriting the identity and privileges of the victim to perform an undesired function on the victim's behalf.

CSRF is an attack in which a user logs in to a website like ABC.com and after login user opens other site called malicious site in another tab, then this malicious site sends request to (ABC.com) valid site using existing credential or existing session for attacking the site. Valid site( ABC.com) assumes that this coming request is a valid request or coming from a valid user, so it executes that request and site is hacked by the CSRF.

A successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

Security Solution:

In ASP.NET MVC:

Client Side:

Protect HTML form by using Html.AntiForgeryToken() inside the form.

@using(Html.BeginForm()) {
@Html.AntiForgeryToken()
-- Rest of the form goes here.
}

This will render something like the following

form action="/UserProfile/Edit" method="post"
input name="__RequestVerificationToken" type="hidden" value="B0aG+O+Bi/5..."
-- rest of form goes here --
/form

Using Html.AntiForgeryToken() will also give visitor a cookie whose name begins with __RequestVerificationToken.
This cookie will contain the same random value as the corresponding hidden field. This value remains constant throughout the visitor’s browsing session and every request to server

Server Side:

Validate incoming form submissions by adding the [ValidateAntiForgeryToken] attribute to the target action method. Here’s an example:

[ValidateAntiForgeryToken]
public ActionResult Edit(string email, string hobby)
{
// Rest of code unchanged
}

This authorization filter ensure checking that the incoming request has a Request.Form entry called __RequestVerificationToken.
And also ensure checking the request comes with a cookie of the corresponding name, and that their (I.e. Form field and Cookie) random values match.

If not, it throws an exception (saying “a required anti-forgery token was not supplied or was invalid.”) and blocks the request.
Else, request is pass thru and response is returned

Note: The MVC Framework’s antiforgery system has a few other handy features:

Antiforgery cookie’s name has a suffix that varies according to the name of your application’s virtual directory. This prevents unrelated applications from accidentally interfering with one another.
Html.AntiForgeryToken() accepts optional path and domain parameters; these are standard HTTP cookie parameters that control which URLs are allowed to see the cookie.

For example, unless you specifically set a path value, the antiforgery cookie will be visible to all applications hosted on your domain (for most applications, this behavior is fine).

__RequestVerificationToken hidden field value contains a random component (matching the one in the cookie), but that’s not all.
If the user is logged in, then the hidden field value will also contain their user name (obtainedfrom HttpContext.User.Identity.Name and then encrypted).
[ValidateAntiForgeryToken] checks that this matches the logged-in user. This adds protection in the unlikely scenario where an attacker can somehow write (but not read) cookies on your domain to a victim’s browser and tries to reuse a token generated for a different user

3). Session Hijacking

In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.

Best way to prevent session hijacking is enabling the protection from the client side. It is recommended that taking preventive measures for the session hijacking on the client side. The users should have efficient antivirus, anti-malware software, and should keep the software up to date.

4). Click Jacking:

Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online.

A better approach to prevent clickjacking attacks is to ask the browser to block any attempt to load your website within an iframe. You can do it by sending the X-Frame-Options HTTP header.

//👇 new code

app.use(function(req, res, next) {

res.setHeader('X-Frame-Options', 'sameorigin');

next();

});

You configured an Express middleware that adds the X-Frame-Options HTTP header to each response for the browser. The value associated with this response header is sameorigin, which tells the browser that only pages of the same website are allowed to include that page within an iframe.

Hope this helps.

Regards,

Arun Manglick

Tuesday, September 29, 2009

Microsoft AJAX CDN

Recently Microsoft has launched a new Microsoft Ajax CDN (Content Delivery Network) service that provides caching support for AJAX libraries (including jQuery and ASP.NET AJAX). The service is available for free, does not require any registration, and can be used for both commercial and non-commercial purposes.

CDNs are composed of "edge cache" servers that are strategically placed around the world at key Internet network points. These "edge cache" servers can be used to cache and deliver all types of content – including images, videos, CSS and JavaScript files.

Using a CDN can significantly improve a website's end-user performance, since it enables browsers to more quickly retrieve and download content. Basically, instead of having a browser request for an image traverse all the way across the Internet to your web server to download, a CDN can instead serve the request directly from a nearby "edge cache" server that might only be a single network hop away from your customer (making it return much faster – which makes your pages load quicker).

e.g. Instead of using the hard path approach, better is to use CDN.

Using CDN with the ASP.NET 4.0 ScriptManager

In addition to allowing you to reference script files directly using a <script> element, ASP.NET 4.0 will make it easy to use the CDN from ASP.NET Web Forms applications that use the <asp:scriptmanager/> server control as below.

<asp:ScriptManager ID="atlSMMaster" EnableCdn="true" runat="server">

</asp:ScriptManager>

When you enable the CDN with the ScriptManager, the application will use the Microsoft CDN to request JavaScript files automatically i.e your application will retrieve all JavaScript files that it normally retrieves from the System.Web.dll or System.Web.Extensions.dll assemblies from the CDN instead. This includes both the JavaScript files within ASP.NET AJAX, as well as the built-in Web Forms JavaScript files (for example: the WebUIValidation.js file for client-side validation, and the JavaScript files for controls like TreeView, Menu, etc).

This provides a nice end-user performance improvement, and means that users accessing your ASP.NET website won’t need to re-download these files if they have visited another ASP.NET website that uses the CDN.

Reference: Link

Hope this helps.

Thanks & Regards,

Arun Manglick || Senior Tech Lead

Sunday, May 27, 2007

ASP.NET 2.0 - Tips & Tricks V1.0

ASP.NET 2.0 offers some great new features that you can implement with a minimal amount of code. I wanted to start a list of some of the most simple (yet cool) things you could do with it that required little or no C#/VB.NET code.

1. Maintain the position of the scrollbar on postbacks: In ASP.NET 2.0 you can simply add the MaintainScrollPostionOnPostBack attribute to the Page directive:

<%@ Page Language="C#" MaintainScrollPositionOnPostback="true" AutoEventWireup="true" CodeFile="..." Inherits="..." %>

2. Set the default focus to a control when the page loads: Using the DefaultFocus property of the HtmlForm control you can easily do this.

3. Set the default button that is triggered when the user hits the enter key: You can now use the HtmlForm control's DefaultButton property to set which button should be clicked when the user hits enter. This property is also available on the Panel control in cases where different buttons should be triggered as a user moves into different Panels on a page.

4. Locate nested controls easily: Finding controls within a Page's control hierarchy can be painful but if you know how the controls are nested you can use the lesser known "$" shortcut to find controls without having to write recursive code. If you're looking for a great way to recursively find a control. The following example shows how to use the DefaultFocus property to set the focus on a textbox that is nested inside of a FormView control. Notice that the "$" is used to delimit the nesting:

<form id="form1" runat="server" DefaultFocus="formVw$txtName">
    <div>
        <asp:FormView ID="formVw" runat="server">
            <ItemTemplate>
                Name:
                <asp:TextBox ID="txtName" runat="server"
                    Text='<%# Eval("FirstName") + " " + Eval("LastName") %>' />
            </ItemTemplate>
        </

This little trick can also be used on the server-side when calling FindControl(). Here's an example:

TextBox tb = this.FindControl("form1$formVw$txtName") as TextBox;
if (tb != null)
{
//Access TextBox contro! l
}

5. Strongly-typed access to cross-page postback controls: If you have a page called Default.aspx that exposes a public property that returns a Textbox that is defined in the page, the page that data is posted to (say SearchResults.aspx) can access that property in a strongly-typed manner by adding the PreviousPageType directive into the top of the page:

<%@ PreviousPageType VirtualPath="Default.aspx" %>

By adding this directive, the code in SearchResults.aspx can access the TextBox defined in Default.aspx in a strongly-typed manner. The following example assumes the property defined in Default.aspx is named SearchTextBox.

TextBox tb = PreviousPage.SearchTextBox;

6. Strongly-typed access to Master Pages controls: If you have public properties defined in a Master Page that you'd like to access in a strongly-typed manner you can add the MasterType directive into a page as shown next:

<%@ MasterType VirtualPath="MasterPage.master" %>

You can then access properties in the target master page from a content page by writing code like the following:

this.Master.HeaderText = "text updated using MasterType directive with VirtualPath attribute.";

7. Validation groups: You may have a page that has multiple controls and multiple buttons. When one of the buttons is clicked you want specific validator controls to be evaluated rather than all of the validators defined on the page. Here's an example:

<form id="form1" runat="server">
    Search Text: <asp:TextBox ID="txtSearch" runat="server" />
    <asp:RequiredFieldValidator ID="valSearch" runat="Server"
      ControlToValidate="txtSearch" ValidationGroup="SearchGroup" />

8. Finding control/variable names while typing code: This tip is a bit more related to VS.NET than to ASP.NET directly. After typing the first few characters of a control/variable name, hit CTRL + SPACEBAR and VS.NET will bring up a short list of matching items. For those who are interested, Microsoft made all of the VS.NET keyboard shortcuts available in a nice downloadable and printable guide-

http://www.microsoft.com/downloads/details.aspx?FamilyID=c15d210d-a926-46a8-a586-31f8a2e576fe&DisplayLang=en

Thanks & Regards,

Arun Manglick

SMTS || Microsoft Technology Practice || Bridgestone - Tyre Link || Persistent Systems || 3023-6258

Labels

Wednesday, May 16, 2007

Friday, January 18, 2008

Wednesday, January 27, 2010

Tuesday, April 29, 2008

Monday, May 12, 2014

Tuesday, September 29, 2009

Microsoft AJAX CDN

Using CDN with the ASP.NET 4.0 ScriptManager

Sunday, May 27, 2007