Web Application Security in .Net

Introduction to Application Security

Security threat is the most serious issue experienced by all not in application but also in all space, how a house without proper security amenities will possess security threat from the foreign objects similar to that web applications are also possess the vulnerable attacks by the unintended users, Because of this critical part the intended users of the web application faces the loss of their privacy, integrity sometimes their resources also.

What is Application Security?

Application security is a mechanism, Practices & procedures to safeguard the resources of the application, ensure the proper privacy of the users and their information’s, proper privileges & rights management.

Application security principles

1.       Principle of least privileges to be adopted: - To avoid and limit the impending damage processing of script or the execution of code should be routed via least privileged account.

2.       Practice the defense mechanism should be in depth: - Place the check point in each & every layer of the application and validate the credentials and authorize the users to access the next levels.

3.       Do not trust on user input: - Validate the all user inputs before computing any operations and preventive measure to be taken.   

4.       Practice secure defaults: - Employ common security standards to application to reduce the settings of security.

5.       Validate input at the gate: - Authenticate the user at the entry level of the application will minimize the security risks.

6.       Fail to a secure mode: – inform the user by limited error message if application fails and do not leave valuable data unprotected. 

Types of Common web application attacks
 

There are several attacks which are frequently exploited by hackers and some common attacks are,

1.       SQL Injection

2.       Cross Site Scripting (XSS)

3.       Malware Execution

4.       Denial of service

5.       Cracking unsecured passwords

6.       Breaking of insecure Session Management

Security Practices in .Net

The basic security feature Authentication and Authorization should be used in applications to avoid and minimize the security threats. Let's see what is Authentication and authorization,

Authentication: -“ Authentication is the mechanism whereby systems may securely identify their clients positively. Authentication systems provide answers to the questions:

·         Who is the user?

·         Check whether the user exist or not in the system?

Types of Authentication:- 
 

1.       Forms based Authentication :- The logon form prompts credentials of user and the inputs are authenticated by means of the server

2.       Windows Authentication :- Authenticate the users to accessing the application by having their existing user accounts within the local user database of the Web server or Active Directory.

3.       Passport authentication :- Authenticate by means of web service provided by Microsoft's Passport, Which is a centralized authentication service provided by Microsoft that offers a single logon and core profile services for member sites.

Authorization: - It is the mechanism by which a system determines what level of access a particular authenticated user should have to secure resources controlled by the system. In simple, user has right to access specific data or not.

Types of Authorization:-

1.            URL Authorization

2.            File Authorization

3.            Authorization based on ACLs

Google's "GO"

Google released of a new, open sourced programming language called Go. The company says that Go is experimental, and that it combines the performance and security benefits associated with using a compiled language like C++ with the speed of a dynamic language like Python.


Here’s how Google describes Go in its blog post:

Go attempts to combine the development speed of working in a dynamic language like Python with the performance and safety of a compiled language like C or C++. In our experiments with Go to date, typical builds feel instantaneous; even large binaries compile in just a few seconds. And the compiled code runs close to the speed of C. Go is designed to let you move fast.

We’re hoping Go turns out to be a great language for systems programming with support for multi-processing and a fresh and lightweight take on object-oriented design, with some cool features like true closures and reflection.

For more details check out Golang.org.

eTMS

eTMS is designed for managing the training programmes in your organization. Publishing new training programmes, updating the annual training calendar, monitor the enrollment of the participants, managing the training resources and tracking the learning history. eTMS is a secure and robust system with the features you require to manage the training activities with ease. E Mail notifications and reminders help to keep the participants on track with their learning activities. Participants on their own can completely access or track their training information


Try it....

in reference to: eTMS - Electronic Training Management System (view on Google Sidewiki)

Hide the div on Mouse click - Javascript

The following Program is the easiest way to hide the div control on Mouse click event. The simple java script function is used to check and validate the click event and Enabling and disabling the div.The main theme of the program is to hide the div on mouse click event on any part of the of page other than the parent div.

Lets try it, if any problem post your comments

How to implement rad tooltip control in web application

• Introduction
• Features
• Some important properties
• Integration of RadTool tip with other controls
• Summary
• Conclusion

1. Introduction

         Tool tip control can display the rich content including not only text and images, but also some interactive forms with standard ASP.NET and user controls. This will allow you to create context sensitive interfaces which do not permanently occupy space on the form. The Rad Tool tip and Rad Tool tip manager are used to show rich web contents like ASP.net Controls, Ajax generated Contents etc.,

• Rad Tool tip control should be used for single elements like how the normal tool tip control that is used in labels, buttons etc.

 • Rad Tool tip manager control should be used where a collection of elements would require a tool tip i.e. data bound Controls, Calendar etc.

The only difference between these controls is the place where we implement them in the form.

2. Features

 • Load on Demand: Instead of preloading all tooltip content, the built-in ASP.NET AJAX mechanism makes it to load only after the user hovers with the mouse over the trigger element. So this is useful to show large contents in tooltip and it improves the page performance.

 • Tooltip Positioning: The position of the tooltip can be configured manually by using the properties such as; Relativeto, Position, OffsetX and OffsetY properties.

 • Content Scrolling: If the content shown in the tool tip control exceeds the control size, then the content can be scrolled horizontally and vertically.

3. Some Important properties

• TargetControl ID - the ID of the control for which the tooltip should appear on the client or the property that specifies the ID of the element that should be 'tooltipified'.

Client Side:

Server Side

 
 
• IsClient ID - True if the TargetControlID is a client id. By default, RadTooltip assumes a server ID. If the ID is client-side, as in the case where an element is pure HTML and not a server control, then the IsClient property should be set to True.

 
Server side:

• On Ajax update – event to supply the content of tool tips generated by RadToolTipManager.

 

Client side:

rad_Ajaxupdate – this function is fired when targeted control is triggered and the function is written in .vb file.

 

By using RadToolTipManager with an AjaxUpdate event handler, you keep the size of your Web page down because the content of tool tips does not have to be loaded until it is used.

• Show Events – This property helps to set the event on which the tool tip has to be shown.

For e.g. ShowEvent="OnClick" means left click on the mouse button, the targeted control tooltip will be dispayed on the form.

4. Integration of Tooltip with other controls

 

The two tool tip controls share most of the same properties. When assigned to RadToolTipManager, a property affects all of the tool tips it generates, while when assigned to RadToolTip it affects the single generated tooltip.

 • Implementation of tooltip in databound Controls

•  Add the Rad Tool Tip Manager and Data List control in the markup page; Assign the data source to Datalist.
• At the time of Item Data bound event add the target Controls and the clientID for Tooltip control.
• Two events are mandatory to fire the tool tip

              OnAjaxUpdate and UpdateToolTip

o The content shown in the tooltip control can be in the same page / form or else it can be a user control.

For e.g.

Here ’EmployeeDetail.ascx’ is a user control and it can be converted into an individual Control and it is added to a template container of the ToolTip in UpdateToolTip event Handler.

Code for adding Target controls in Item databound

 

 

lblProgramNameValue is a target Control in the datalist.

 While mouse over on the Targeted control ie.. Employee Name in the datalist, the Corresponding EmployeeID will pass through OnAjaxUpdate event handler

The OnAjaxUpdate event, Calls the function UpdateToolTip by passing EmployeeID as args.Value

• The content or control shown in tool tip should be added to ContentTemplateContainer, here we are showing dlEmployeeDetails (Datalist Contains details about Employee)

• Source assign code for dlEmployeeDetails is written in the Function MouseOver(EmployeeID)

Note:

Tooltip control works better in data bound controls when paging and sorting option is disabled; if paging option is used in Databound controls then, the target controls collection should be cleared while navigating the page else the Same ’ID’ will be passed in each page navigation. Consider the scenario - In Page 1 the 3rd count ID is “123” in Page 2 the 3rd count ID is “456”, while navigating to second page instead of “456” the ID “123” will pass through the Ajax update Function. To rectify this problem,

in Item_Command Event

Sort – sorting Function and Page – For Paging Function.

• Implementing Tooltip in Calendar control.

Implementation of Tooltip with calendar control is simpler. In Datalist control, the Target control is added in Item_DataBound, similar to that, in a Calendar control the target control is added in a Day_Render event.

For e.g.: In Day_Render Event of Calendar,

Then Call: OnAjaxUpdate and Update tooltip Event as shown in data bound controls.

Note:

If Updatepanel or Ajax panel is used for the calendar control, then the Tooltip is shown only for the current month and for the previous month or the next month, the tooltip will not be displayed. For this scenario, we have to use RadAjaxManager control to update the ToolTip controls with the calendar.

 To solve this problem follow this code below:

ClientSide:

The calendar control should be referred in AjaxSetting and AjaxUpdatedControl and the Tooltip control in AjaxUpdatedControl.

Summary

• In this blog we sawn about Basics of Radtooltip’s important properties and Features.

• Basic events of RadTooltip
• Integration of Radtooltip with Databound Control and Calendar control.

Conclusion

From this blog you are able to understand about basics of Rad Tooltip control, important properties and how to implement and integrate this control with Data bound controls and calendar control.

Remove HTML tags from string

It’s so easy to remove HTML tags from your text or code instead of using the lengthy codes or functions, just use these regular expression in your coding,



Regular Expression: "<[^>]*>"


Eg Code: Vb.net


Public Function RemoveHTMLTab(ByVal pHTMLString As String) As String

     Return System.Text.RegularExpressions.Regex.Replace(pHTMLString, "<[^>]*>", String.Empty)

End Function


Eg Code : C#.net

public string RemoveHTMLTab(string pHTML) as string

{
    return System.Text.RegularExpressions.Regex.Replace(pHTMLString, "<[^>]*>", string.Empty);
}

Google's Fabulous Search

With the fabulous search of google u can search more and more what u excepted. The results from the google are outstanding when compare to the other browsers.

And these features are Really amazing and the utilities like Translation,blogs, are need for our routine life.

in reference to: Google (view on Google Sidewiki)

Change the name of the .net Extension (.aspx, .ascx etc,)

Step 1:

IIS Configuration
Open Internet Information Services console, Click Properties of Default Website. In the default website properties, under the Home directory tab, click Configuration button as show in Fig :1

Fig : 1

 Step 2:

In the application configuration, the application extension mapping should be done for the aspnet_isapi.dll
Click Add button in Application Configuration as shown in Fig 2, it will shown Add/Edit Application Extension mapping as shown in Fig 3.

Fig : 2

Step 3:

In the Add/Edit Application Extension mapping, add the followings,
Executable - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
Extension - .Sample
Verbs - Limit to: GET, HEAD, POST, DEBUG

Fig : 3

The executable path is must - to deal with aspnet_isapi.dll, the Extension need to be provided instead of .aspx, the verbs limit to is must and Check out the option check that file exists


Step: 4

Web Config settings

1. In the application web.config file, the PageHandlerFactory should be implemented, to call the ASP.NET compilation system to compile, if necessary, and return the exact type corresponding to the URL, and then creates an instance of that type

Add the following code under http handlers section in web.config file

2. Build Provider

Need to Implement build provider in the web.config file to compile custom resource files of a particular file type and to generate code during compilation.There are separate build providers for each type of file, if the extension of the webform file is going to be changed Corresponding build provider should be implemented, the default Build provider for webform file is,

" add extension=".Sample" type="System.Web.Compilation.PageBuildProvider" "

customizable extension (ie., .Sample) is added in the extension tag.

The build provider should add under

The Default build provider for different file types are given below,

Step 4:

 In your application change the extension of the File, and run the application, For eg., Javascript.aspx is included in your file change in to JavaScript.Sample .

Microsoft Bing

After a long wait Microsoft ready to launch Search Engine -'Bing'. It makes people for better decisions at Bing.com.

Decision Engine goes beyond search to help customers deal with information overload.

The result of this new approach is an important beginning for a new and more powerful kind of search service, which Microsoft is calling a Decision Engine, designed to empower people to gain insight and knowledge from the Web, moving more quickly to important decisions. The new service, located at http://www.Bing.com, will begin to roll out over the coming days and will be fully deployed worldwide on Wednesday, June 3.

"Today, search engines do a decent job of helping people navigate the Web and find information, but they don't do a very good job of enabling people to use the information they find," said Steve Ballmer, Microsoft CEO. "When we set out to build Bing, we grounded ourselves in a deep understanding of how people really want to use the Web. Bing is an important first step forward in our long-term effort to deliver innovations in search that enable people to find information quickly and use the information they've found to accomplish tasks and make smart decisions."

Microsoft's popular cashback program, now dubbed Bing cashback, with more than 850 merchants and more than 17 million products available, will be fully integrated into the Bing Shopping experience.

Microsoft is committed to building better tools to help people find the shortest distance from their initial search query to the point of making an informed decision. Bing is an important first step toward this long-term vision and a strong indicator of Microsoft's commitment to move search technology forward for customers.

Bug is simply (not) a bug

Severity Wise:

• Major: A defect, which will cause an observable product failure or departure from requirements.
• Minor: A defect that will not cause a failure in execution of the product.
• Fatal: A defect that will cause the system to crash or close abruptly or effect other applications.

Work product wise:

• SSD: A defect from System Study document
• FSD: A defect from Functional Specification document
• ADS: A defect from Architectural Design Document
• DDS: A defect from Detailed Design document
• Source code: A defect from Source code
• Test Plan/ Test Cases: A defect from Test Plan/ Test Cases
• User Documentation: A defect from User manuals, Operating manuals

Type of Errors Wise:

• Comments: Inadequate/ incorrect/ misleading or missing comments in the source code
• Computational Error: Improper computation of the formulae / improper business validations in code.
• Data error: Incorrect data population / update in database
• Database Error: Error in the database schema/Design
• Missing Design: Design features/approach missed/not documented in the design document and hence does not correspond to requirements
• Inadequate or sub optimal Design: Design features/approach needs additional inputs for it to be completeDesign features described does not provide the best approach (optimal approach) towards the solution required
• In correct Design: Wrong or inaccurate Design
• Ambiguous Design: Design feature/approach is not clear to the reviewer. Also includes ambiguous use of words or unclear design features.
• Boundary Conditions Neglected: Boundary conditions not addressed/incorrect
• Interface Error: Internal or external to application interfacing error, Incorrect handling of passing parameters, Incorrect alignment, incorrect/misplaced fields/objects, un friendly window/screen positions
• Logic Error: Missing or Inadequate or irrelevant or ambiguous functionality in source code
• Message Error: Inadequate/ incorrect/ misleading or missing error messages in source code
• Navigation Error: Navigation not coded correctly in source code
• Performance Error: An error related to performance/optimality of the code
• Missing Requirements: Implicit/Explicit requirements are missed/not documented during requirement phase
• Inadequate Requirements: Requirement needs additional inputs for to be complete
• Incorrect Requirements: Wrong or inaccurate requirements
• Ambiguous Requirements: Requirement is not clear to the reviewer. Also includes ambiguous use of words – e.g. Like, such as, may be, could be, might etc.
• Sequencing / Timing Error: Error due to incorrect/missing consideration to timeouts and improper/missing sequencing in source code.
• Standards: Standards not followed like improper exception handling, use of E & D Formats and project related design/requirements/coding standards
• System Error: Hardware and Operating System related error, Memory leak
• Test Plan / Cases Error: Inadequate/ incorrect/ ambiguous or duplicate or missing - Test Plan/ Test Cases & Test Scripts, Incorrect/Incomplete test setup
• Typographical Error: Spelling / Grammar mistake in documents/source code
• Variable Declaration Error: Improper declaration / usage of variables, Type mismatch error in source code

Google squared

-->

The search engine is a bit different animal. According to Google, "Google Squared is an experimental search tool that collects facts from the web and presents them in an organized collection, similar to a spreadsheet. If you search for [roller coasters], Google Squared builds a square with rows for each of several specific roller coasters and columns for corresponding facts, such as image, height and maximum speed."

This one is easier to see than explain. Here are the results from search supreme court justices.

Next generation data warehousing is here. Google Squared is an amazing technology with which you can build squares of data. I am very interested to see whether we can achieve a "data schema" with which we are able to build "people square" based on our product data. That would be taking people data warehousing to next level.