|
Good day
We have a asp.net website high traffic website. When a user registers we store the ip address i that user,when the login we store all ip addreses he used and we have a blocking module which blocks a username and all the ip's associated with that username. So that those who want to create other accounts from same location will be blocked. This morning we had few incidents where we needed to block the fake user. Can anyone scrutinise my approach and there is anything to my approach that i can add to make it rock solid i would appreciate. We also have a mobile app which also does the same in terms of Imei and it blocks the phones which is easy.
Vuyiswa Maseko,
Spoted in Daniweb-- Sorry to rant. I hate websites. They are just wierd. They don't behave like normal code.
C#/VB.NET/ASP.NET/SQL7/2000/2005/2008
http://www.vimalsoft.com
vuyiswa[at]vimalsoft.com
|
|
|
|
|
You can ask Chris how hard it is to block the same user, based on data from some previously banned account...
As you may already know IP banning has it disadvantages, but to be honest, there is no really reliable method to block new users based on old data...
No IP address, no email, no user-name and nothing other will for sure connect one account to an other, so always will miss someone bad, why probably block someone innocent...
So with all the sorrow - there is no 'rock solid' solution, but bad and worst only...
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
Unfortunately it is very hard to identify the users using IP addresses because for some ISPs all customers might have similar IP address. The only way of doing this is installing small programs in the browser and getting their MAC address which is unique for all users but which is not possible without user permission.
|
|
|
|
|
I'm trying to use gSOAP with C++ to pass a std::list of a simple structure using the soapstd2 compiler to generate the relevant WSDL for a legacy application that I'm trying to offer as a web service.
Heres the gSOAP header that I have defined in the legacy C++ app:
#import "stl.h"
class ns__arpaTarget
{
public:
int nTgtNo;
std::string name;
double dRange;
double dBearing;
ns__arpaTarget();
~ns__arpaTarget();
};
class ns__arpaList
{
public:
std::list <ns__arpaTarget> arpa_lst;
};
int ns__getArpaList( ns__arpaList* lst );
I'm compiling this within Visual Studio 2008, with the following pre build event to generate the WSDL:
W:\gSOAP\gsoap-2.8\gsoap\bin\win32\soapcpp2 -I W:\gSOAP\gsoap-2.8\gsoap\import -t W:\gSOAP\gsoap-2.8\gsoap\WS\typemap.dat -j -s gSOAPArpaWebService.h
This is all building fine at the server end (I have an implementation of the function which builds and runs and supplies a list of my simple structure) - it's also generating the WSDL which looks like this:
="1.0"="UTF-8"
<definitions name="Arpa"
targetNamespace="http://localhost:5801/arpa.wsdl"
xmlns:tns="http://localhost:5801/arpa.wsdl"
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:ns="http://localhost:5801/arpa.wsdl"
xmlns:SOAP="http://schemas.xmlsoap.org/wsdl/soap/"
xmlns:HTTP="http://schemas.xmlsoap.org/wsdl/http/"
xmlns:MIME="http://schemas.xmlsoap.org/wsdl/mime/"
xmlns:DIME="http://schemas.xmlsoap.org/ws/2002/04/dime/wsdl/"
xmlns:WSDL="http://schemas.xmlsoap.org/wsdl/"
xmlns="http://schemas.xmlsoap.org/wsdl/">
<types>
<schema targetNamespace="http://localhost:5801/arpa.wsdl"
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:ns="http://localhost:5801/arpa.wsdl"
xmlns="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"
attributeFormDefault="unqualified">
<import namespace="http://schemas.xmlsoap.org/soap/encoding/"/>
<complexType name="arpaTarget">
<sequence>
<element name="nTgtNo" type="xsd:int" minOccurs="1" maxOccurs="1"/>
<element name="name" type="xsd:string" minOccurs="1" maxOccurs="1"/>
<element name="dRange" type="xsd:double" minOccurs="1" maxOccurs="1"/>
<element name="dBearing" type="xsd:double" minOccurs="1" maxOccurs="1"/>
</sequence>
</complexType>
<element name="getArpaList">
<complexType>
<sequence>
</sequence>
</complexType>
</element>
<element name="arpaList">
<complexType>
<sequence>
<element name="arpa-lst" type="ns:arpaTarget" minOccurs="0" maxOccurs="unbounded"/>
</sequence>
</complexType>
</element>
</schema>
</types>
<message name="getArpaList">
<part name="Body" element="ns:getArpaList"/>
</message>
<message name="arpaList">
<part name="Body" element="ns:arpaList"/>
</message>
<portType name="ArpaPortType">
<operation name="getArpaList">
<documentation>Service definition of function ns__getArpaList</documentation>
<input message="tns:getArpaList"/>
<output message="tns:arpaList"/>
</operation>
</portType>
<binding name="Arpa" type="tns:ArpaPortType">
<SOAP:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="getArpaList">
<SOAP:operation soapAction=""/>
<input>
<SOAP:body parts="Body" use="literal"/>
</input>
<output>
<SOAP:body parts="Body" use="literal"/>
</output>
</operation>
</binding>
<service name="Arpa">
<documentation>service described at http://localhost:5801/ArpaService</documentation>
<port name="Arpa" binding="tns:Arpa">
<SOAP:address location="http://localhost:5801/arpaserver.cgi"/>
</port>
</service>
</definitions>
At the client end I'm referencing the generated gSOAP WSDL and successfully importing the service via an ASP.NET web application - but when I try to use the service function of the imported service to retrieve the list of ns__arpaTarget types the service only offers the following function signature that I don't understand or know how to use (perhaps this is my problem?):
Radar_Services_Web_Client.ArpaSrv.arpaTarget[] ArpaPortTypeClient.getArpaList( Radar_Services_Web_Client.ArpaSrv.getArpaList getArpaList1 )
Note: I have tried this without a list and I am able to get a single structure out from the service into the client call successfully. I've also tried a list of pointers to ns__arpaTarget - as the gSOAP documentation tells me this is a safer way of doing so but the same problem occurs (i.e. I get the same strange signature to use in the client).
Any help would be greatly appreciated. Many thanks, Gary.
|
|
|
|
|
Error Is: System.ArgumentOutOfRangeException: Index was out of range. Must be non-negative and less than the size of the collection.
Parameter name: index
controller code:
public ActionResult Edit(int id = 0)
{
Student1 student1 = new Student1();
StudentCRUD stud = new StudentCRUD();
var st = stud.SelectById(id);
if (st != null)
{
student1.First_Name = st.First_Name;
student1.Middle_Name = st.Middle_Name;
student1.Last_Name = st.Last_Name;
student1.Contact_No = st.Contact_No;
student1.Email_ID = st.Email_ID;
student1.Temp_Address = st.temp_Address;
student1.Permanant_Address = st.permanant_address;
student1.CountryName = st.CountryName;
student1.StateName = st.StateName;
student1.CityName = st.CityName;
}
ViewBag.CityID = new SelectList(db.Cities, "CityID", "CityName", student1.CityID);
ViewBag.CountryID = new SelectList(db.Countries, "CountryID", "CountryName", student1.CountryID);
ViewBag.StateID = new SelectList(db.States, "StateID", "StateName", student1.StateID);
return View(student1);
}
StudentCRUD Class:
public Sp_FindbyId_Result SelectById(Nullable<int> stid)
{
var stud = db.Sp_FindbyId(stid).ToList();
return (stud[0]); // Error coming here
}
|
|
|
|
|
That means there are no entries in your list. You need to use your debugger to find out why you did not retrieve any records.
|
|
|
|
|
First check that the method "db.Sp_FindbyId(stid)" return any value or not.
this exeception is because in code var stud = db.Sp_FindbyId(stid).ToList();
stud is not having any recored.
In this case better to use
return (stud.FirstOrDefault())
|
|
|
|
|
Thanks ...Richard MacCutchan & Kunwar Bahadur Singh
|
|
|
|
|
You could put a check before accessing the value from the list
var stud = db.Sp_FindbyId(stid).ToList();
if (stud.Count() > 0 ){
return (stud[0]);
}else{
}
|
|
|
|
|
FirstOrDefault will do exactly the same thing, as suggested in the reply above yours. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
I agree , that will do as well. Thanks for pointing out to me. I think I overlooked the last line.
|
|
|
|
|
Hello
I have been trying for some time to log-in to a site who register.aspx page works (new user's details are inserted in the database).
However, when I use those same details of a user (email and password) to log-in, I am not able to. I get no debug errors in Visual Studio 2013 for Web or server errors. The form just stands still when I click the logon button.
Are there are glaring errors, please, in my log-on code? In my aspx file, the two form fields are ID = strEmail and ID = password:
Protected Sub LogonBtn_Click(sender As System.Object, e As System.EventArgs) Handles LogonBtn.Click
Try
Using conn As OleDbConnection = New OleDbConnection(System.Configuration.ConfigurationManager.ConnectionStrings("students").ConnectionString)
conn.Open()
Dim strEmailValue As String = strEmail.Text
Dim passwordValue As String = password.Text
Dim MSAccess As String = "Provider=Microsoft.Jet.OleDb.4.0; Data Source=|DataDirectory|students.mdb;"
Dim ConnectionString As String = "SELECT * FROM university WHERE strEmail = '" & strEmailValue & "' AND [password] = '" & passwordValue & "'"
Dim cmd As New OleDbCommand
Dim reader As OleDbDataReader = cmd.ExecuteReader
Dim strEmailFound As Boolean = False
Dim passwordFound As Boolean = False
'if in database:
While reader.Read
strEmailFound = True
strEmailValue = reader("strEmail")
passwordFound = True
passwordValue = reader("password")
End While
conn.Close()
'check result
If strEmailFound = True And passwordFound = True Then
Dim target = String.Format("~/userpage.aspx?strEmail={0}", strEmailValue)
Response.Redirect(target, True)
End If
End Using
Catch ex As Exception
Console.WriteLine(ex.Message)
Dim MessageBox As String
MessageBox = "Sorry, email or password not found"
End Try
End Sub
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
'Dim strEmailValue As String = ""
'Dim strEmailValue As String = strEmail.Text
If Not IsPostBack Then
strEmail.Text = String.Format("{0}", Request.QueryString("strEmail"))
End If
LblDate.Text = ReturnDate()
strEmail.Focus()
End Sub
End Class
Many thanks!
|
|
|
|
|
Apart from the potential for SQL injection problems with your database, do you really want to store passwords in clear text?
[edit]
Also look at the following sequence:
While reader.Read
strEmailFound = True
strEmailValue = reader("strEmail")
passwordFound = True
passwordValue = reader("password")
End While
You are setting both variables to True without actually checking whether you have found the specific entries in the database. You need to read through your code carefully and check your logic.
[/edit]
|
|
|
|
|
Hello Richard
Many thanks for your reply.
Yes, there are a couple of flaws - plain text passwords as opposed to salting/hashing, and empty form fields - but for the moment I just wanted to get the engine started and then, when I can log in, I will explore those other important features of a log-in form.
Thanks for pointing out the While reader.Read/End While
You mean it's not actually doing anything?!
Thanks again for your reply.
|
|
|
|
|
Look again at my previous reply and the (il)logic of that loop. As soon as you come out of the loop you assume that there has been a match with the email and password entered by the user, but the two variables will contain the last found items.
|
|
|
|
|
I am trying to tidy it up a little. I didn't have these namespaces in, for example, beforehand:
Imports System.Data.OleDb.OleDbCommand
Imports System.Data.OleDb.OleDbDataReader
and the 'order' is OleDbConnection, an OleDbCommand, and an OleDbDataReader. The While/End While code should then read through the data, before closing OleDbDataReader, and then OleDbConnection.
That structure is now reflected in my own code.
The examples I have see around look a lot like this:
dr = myCommand.ExecuteReader()
While dr.Read()
'reading from the datareader
MessageBox.Show("colname1" & dr(0).ToString())
'displaying the data from the table
End While
dr.Close()
I probably need to use something like this
("colname1" &
dr(0).ToString()) from the example above, but I don't want the code to display anything - only to log me on.
As I said earlier, the code I initially posted doesn't actually 'read' the rows, does it?
|
|
|
|
|
Member 8761667 wrote: the code I initially posted doesn't actually 'read' the rows, does it?
No idea, you need to do some debugging to check it. I have tried to explain where the logic is wrong in your loop, but you seem to be looking elsewhere.
|
|
|
|
|
As I understand it, the logic should be to read the database using While and End While. In the database, where there are two columns called 'password' and 'strEmail' (the exact same IDs as for the two form fields), the code should check that the email variable (strEmailValue) entered in the email form field is the same as the entry in the database column whose name is strEmail.
(strEmail is the name of the database column AND the email text field in the form, whereas strEmailValue is the variable entered by the user in the form text field.)
If the entry in the database column is the same as the variable entered by the user, then it is true that strEmailValue has been found - hence strEmailFound = True.
Likewise, for password. The code should check that the password variable (passwordValue) entered in the password form field is the same as the entry in the database column whose name is password.
(password is the name of the database column AND the password text field in the form, whereas passwordValue is the variable entered by the user in the form text field.)
If the entry in the database column is the same as the variable entered by the user, then it is true that passwordValue has been found - hence passwordFound = True.
So, I now have:
While reader.Read
If strEmailValue = reader("strEmail") Then
strEmailFound = True
End If
If passwordValue = reader("password") Then
passwordFound = True
End While
Does the above make sense?
Thanks again.
|
|
|
|
|
Yes, that makes some sense. However, you only need a single variable to indicate that you have found the correct user record. Also, you should check the password inside the email test, to ensure you capture the two settings for a single user entry, something like:
bool userFound = false
While reader.Read
If strEmailValue = reader("strEmail") Then
If passwordValue = reader("password") Then
userFound = True
Exit While
End If
End If
End While
|
|
|
|
|
Hello Richard
Many thanks.
I will debug all the code again and give it a trial run.
Before my previous While/End While, I had:
Dim strEmailFound As Boolean = False
Dim passwordFound As Boolean = False
but if I use your
Dim userFound As Boolean = False
I can delete my two declarations because, as you say, 'you only need a single variable to indicate that you have found the correct user record'.
Does it matter which variable finds the record?
Thank again for all your help.
|
|
|
|
|
Member 8761667 wrote: Does it matter which variable finds the record?
No, but as I said before, you only need one variable, to tell when you have found the record that matches both userid and password.
|
|
|
|
|
|
Thanks for the links, Richard.
I have just taken a look at this page:
Secure Password Authentication Explained Simply[^]
which looks up-to-date (referring to SHA512 and RNGCrypto), and I have put your post into my favourites but, as I say, I will investigate the While/End While first.
|
|
|
|
|
Error:
Missing type map configuration or unsupported mapping.
Mapping types:
sp_selectall_Result -> Student1
MvcCRUD6.Models.sp_selectall_Result -> MvcCRUD6.Models.Student1
Destination path:
List`1[0]
Source value:
MvcCRUD6.Models.sp_selectall_Result
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: AutoMapper.AutoMapperMappingException: Missing type map configuration or unsupported mapping.
Controller Code:
public ActionResult Index()
{
Mapper.CreateMap<Student, Student1>();
var dbContext = new WorkTraningEntities();
StudentCRUD stud = new StudentCRUD();
var students = stud.SelectAll();
List<Student1> stud1 = Mapper.Map<List<Student1>>(students);
return View(stud1);
}
Index View:
@model IEnumerable<mvccrud6.models.student1>
@{
ViewBag.Title = "Index";
}
Index
@Html.ActionLink("Create New", "Create")
@foreach (var item in Model) {
}
@Html.DisplayNameFor(model => model.First_Name)
| @Html.DisplayNameFor(model => model.Middle_Name)
| @Html.DisplayNameFor(model => model.Last_Name)
| @Html.DisplayNameFor(model => model.Contact_No)
| @Html.DisplayNameFor(model => model.Email_ID)
| @Html.DisplayNameFor(model => model.Temp_Address)
| @Html.DisplayNameFor(model => model.Permanant_Address)
| @Html.DisplayNameFor(model => model.Country.CountryName)
| @Html.DisplayNameFor(model => model.State.StateName)
| @Html.DisplayNameFor(model => model.City.CityName)
| | @Html.DisplayFor(modelItem => item.First_Name)
| @Html.DisplayFor(modelItem => item.Middle_Name)
| @Html.DisplayFor(modelItem => item.Last_Name)
| @Html.DisplayFor(modelItem => item.Contact_No)
| @Html.DisplayFor(modelItem => item.Email_ID)
| @Html.DisplayFor(modelItem => item.Temp_Address)
| @Html.DisplayFor(modelItem => item.Permanant_Address)
| @Html.DisplayFor(modelItem => item.Country.CountryName)
| @Html.DisplayFor(modelItem => item.State.StateName)
| @Html.DisplayFor(modelItem => item.City.CityName)
| @Html.ActionLink("Edit", "Edit", new { id=item.StudentID }) |
@Html.ActionLink("Details", "Details", new { id=item.StudentID }) |
@Html.ActionLink("Delete", "Delete", new { id=item.StudentID })
|
|
|
|
|
|
Hello,
I’m planning to build a website using ASP.net. The members of this site should use a client like Skype. The client should support the following features:
·Audio Chat.
·Text chat and instant messaging.
·Desktop sharing
I do not know the best option to achieve that. Is there an existing library to develop this client? Or I should build the client from scratch? Shall I use SIP, XMPP or other protocols? Can I use Google for work or office 365?
Note: The expected number of users is 100’000 and later in future.
Thanks in advance
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
