Developer Solutions for Web and Other

OATH Authentication Giving access to sensitive information with the users permission. There are usually 4 parties involved in this process. The User, 'The User'. The Application requesting access to the User's data, 'The Requesting Application'. The Application which has the User's data, 'The User's Data Host'. The Application which can grant access to the User's data, 'The Access App'. (A token is just a piece of unique text which the receiver reads and understands and can identify and grant permission to access some data or resource). There are more than 1 steps involved: 'The Requesting Application' requests access to 'The User's data. 'The Requesting Application's request is sent to 'The Access App'. 'The Access App' asks 'The User' if she wishes to grant permission to 'The Requesting Application'. 'The User' agrees and response is sent to 'The...

Web Security - HTTPS, SSL, TLS and Certificates https://www.instantssl.com/ssl-certificate-products/https.html Why is it needed? Man-In-the-Middle attacks (someone reading the information you send and receive and may even change the message). How is it implemented? SSL or TLS. SSL This is the secure protocol i.e. a bunch of rules that creators of browsers like Chrome and IE follow. Replaced by TLS. Certificates are used to hold the information need for the Browsers to implement the SSL.   HTTPS https://www.howtogeek.com/howto/33949/htg-explains-what-is-encryption-and-how-does-it-work/ http://robertheaton.com/2014/03/27/how-does-https-actually-work/ A secure/encrypted version of HTTP, combination of HTTP and SSL or TLS. Verifies that you are talking directly to the server that you think you are talking to. Ensures that only the server can read what you send it and only you can read what it sends back. Anyone can intercept every single o...

The IIS Metabase is XML representation of the IIS instance, it's actually an XML file stored in IIS. It can be access using apps like  MetaEdit   or programmatically using the Active Directory through a class  System.DirectoryServices.DirectoryEntry. using System.Collections.Generic; using System.Text; using System; using System.Data; using System.Configuration; using System.DirectoryServices; using System.Web.Configuration; namespace IISMetabase { class IISMetabase { private string _machineName = "localhost"; private System.Collections.IDictionary _applications;//collection of websites private Configuration _config; public IISMetabase() { _applications = new System.Collections.Hashtable(); } public System.Collections.IDictionary GetApplications() { DirectoryEntry webentry = new DirectoryEntry(); String path = "IIS://" + _machineName + "/W3SVC/1/ROOT"; webentry.Path = path; Boolean exists = false; try { exists = DirectoryEntry.Exists(path); } catch (Sy...

Cookies Cookies are simply a file stored in the client machine which are sent up and down to and from the server with every Request and Response. The Cookie is used to store some client information such as details of their past session. It allows the Client to return to a webpage and have information already available to them without having to start from scratch. The Cookie is first sent down from the Server and is stored somewhere on the Client's hard-drive. It's up to the Web Application developer to do the Cookie processing on the Server side. The Cookie can be accessed from the Request as the Cookie is a property of the HttpRequest, Request.Cookie["cookiename"]; One problem I've encountered with Cookies is that all the cookies associated with your application get Posted from the Client on each Request, this adds to the amount of data sent as you can imagine. There is a solution however, in order to ensure a Cookie is only sent from Client to Server when a cert...