Creating Tamper-Proof URLs 31 Aug 2005 00:00 GMT
One of the unique challenges of building Web applications lies in way by which a Web application can be "invoked" by an end
user. With traditional desktop applications, there is typically a very stringent set of ways the application can be invoked -
by running a particular executable, perhaps passing in a set of command-line parameters. With Web applications, however,
there are, possible, an infinite number of ways that the application can be invoked. With a Web application, each
Web page serves as a public interface to the Web applications, and for Web pages whose functionality is based on user-supplied
parameters (i.e., querystring or form-posted values) each potential input represents a unique interface.
Having a potentially unlimited number of public interfaces greatly increases the complexity and forethought required in
building secure and consistent Web applications. Since URLs can easily be changed by even the most novice user, it is
paramount that you do not place any state information in the querystring that you do not mind the user change, or, if you do,
you need to validate in the web page's code to ensure that the user has not modified the querystring to an unacceptable state.
For example, imagine that you had a website with a page where a user could modify their account. If you simply identified the
logged on user by a UserID value in the querystring, like EditProfile.aspx?UserID=UserID, a
savvy user would notice this and could modify other users' data by simply tweaking the querystring parameter.
However, there are times where important state needs to be passed through the querystring and, under no circumstances, should
be it be able to be modified by the end user. (We'll discuss some of these cases in more detail further on in this article.)
Such tamper-proof URLs can be created quite easily by using a one-way hash to sign the querystring parameters that
you do not want edited and appending that signature to the querystring. The web page being visited, then, can apply the
same hash to the plain-text querystring parameters and ensure that it matches up to the signature included in the querystring.
If the two signatures match, then the querystring parameters have not been modified.
In this article we'll look at how to use one-way hashes to create tamper-proof URLs. As we'll see, only a few short lines
of code are needed to both generate the signature on the page generating the hyperlink and validating the signature on
the "receiving" page. Read on to learn more!
Read More >
Source: 4GuysFromRolla React Quickly to Fraudulent Credit Card Charges using ASP.NET, OFX, and RSS 31 Aug 2005 00:00 GMTCredit card fraud continues to be a real risk, and every card holder is a potential victim. Minimizing the damage from this crime involves early identification of fraudulent transactions--your monthly statement may be too late. Eric Madariaga shows how to use OFX and ASP.NET to consolidate bank and credit card transactions into a personal RSS feed, allowing you to stay informed of all recent transactions.
Source: AspAlliance WinFS Beta 1 SDK Released 30 Aug 2005 17:24 GMTBeta 1 of the WinFS SDK is now available to MSDN Subscribers. Get the bits and the docs, and see how to take advantage of Microsoft’s next-generation relational file system for Windows.
Source: MSDN New Half-Life 2 Mod Spot on Coding4Fun! 30 Aug 2005 16:13 GMTOne of the best game platforms for modding is Half-Life 2's 'Source' engine. Coding4Fun has partnered with Valve Software to compile some of the best community sites to help you get started creating your own mods, or even completely new games.
Source: MSDN What's New in .NET 2.0 for Assemblies and Versioning? 30 Aug 2005 02:04 GMT.NET 2.0 and Visual Studio 2005 have numerous innovations regarding assemblies and versioning. You can add a reference to an EXE assembly, resolve type conflicts by aliasing a reference, given permission, you can access the internal types of another assembly, protect and manage with ease your strong name keys, insist on building against a specific version of an assembly, and target specific CPU architectures.
Source: DevX Creating a DropDownLabel Server Control 30 Aug 2005 00:00 GMTServer controls are the life force behind ASP.NET development. The server controls that come with the ASP.NET framework are fantastic, but sometimes they do not perform the exact task that is required. Luckily, Microsoft has designed the server control model so that developers can extend and implement their own custom server controls based on the ASP.NET control set. This article will explain some of the concepts in custom server control design, and also provide a walkthrough on how to create a custom DropDownLabel control.
Source: AspAlliance