Re: Is Server.Transfer secure?

From: Tim Almond (anon_at_anon.co.uk)
Date: 08/26/03

  • Next message: Sherif ElMetainy: "Re: ASP.NET + SQL Server Windows authentication" 
    Date: Tue, 26 Aug 2003 17:00:51 +0100

    "Chris Jackson" <chrisj@mvps.org> wrote in message
    news:%23SGMy89aDHA.384@TK2MSFTNGP12.phx.gbl...
    > If you use Server.Transfer, you can always use
    > System.Web.HttpContext.Items.Add to pass something in to your request to
    the
    > new page.
    >
    > As for retrieving properties from the source page, any time you rely on
    > information that comes from the client, you can't trust it. So, if you're
    > getting it from session state, then you are fine. But, say for example,
    that
    > you have a form that gives you options based on your credentials. As an
    > employee, I may have the option of requesting a vacation day, but as a
    > manager I can request, approve, or deny a vacation day. If I am a
    malicious
    > user, I can just create my own HTML form to post back an approval, even
    > though I wouldn't see that option on the form that you gave me.
    >
    > Viewstate is a way for the server to pass information back and forth from
    > itself - nothing is added to it on the client side.
    >
    > --
    So to use Server.Transfer, I'd still have to validate the Case Code against
    the user ID on the page in case the input had been hacked? I thought the
    idea of the Server.Transfer was that it was like an internal 'pass'.

  • Next message: Sherif ElMetainy: "Re: ASP.NET + SQL Server Windows authentication"

    Relevant Pages

    • Re: breaking the model
      ... > The forms data then is in the Request object. ... HTTP Request; in this case, the form POST Request from the Page. ... client and server. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Resolving record with enumerated type
      ... In a CPU BFM package, ... because data goes in two directions (request from the ... from the server to the client), you'll need some way to orchestrate ...
      (comp.lang.vhdl)
    • Re: WSE 3.0 + UserNameToken without X.509 Cert/Kerberos + Signing + Encryption How?
      ... I still think that there is a lot of benefit for Secure Conversation ... message security and thefore it does not encrypt the message. ... between client and server using a UserNameToken that passes the UserName ... assuming the client request adds a proper UserNameToken... ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • RE: Problems with wsdl-generated proxy clients
      ... the client gets the same error on my xp ... meaning that the request was malformed. ... Microsoft MSDN Online Support Lead ... Looking at the IIS logs, I didn't even see the request in the log. ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Performance Issue with Runtime Image
      ... >> the client, closes the connection, then dies. ... request before even accepting the next incoming connection. ... The client program is unaffected so presumably the server is ...
      (comp.lang.smalltalk.dolphin)