CSRF token protection using cookie -

-

is practice save csrf token in cookie or better use hidden field in form? regenerate csrf token every user request captchas doing?

thanks

it best include in form. idea behind csrf token is not passed passively (e.g. if malicious user able trick browser accessing url nasty). cookies passed passively.


Comments

Post a Comment

Popular posts from this blog

php - URL redirection after form submitted without inherited params -

-
i working on web site using php , jquery mobile . on page have form: <form method="post" name="form1" id="form1" onsubmit="return comprobardatos()" data-ajax="false" action="<?php echo $editformaction; ?>"> <p> nombre: <input type="text" name="nombre_plato" id="nombre_plato" value="" size="32" > <div id="mensajealias"></div><div id="ajaxbusy" style="display: none;"><p><img src="wait.gif"></p></div> </p> <p>descripción: <input type="text" name="descripcion_plato" id="descripción_plato" value="" size="32"><div id="mensajenombre"></div> </p> <p>precio 1: <input type="text" name="precio1_plato" value="" onkeypress=...
Read more

c# - ReportViewer control - axd url -

-
i've embedded microsoft.reporting.webforms.reportviewer control in aspx. site works on mysite.com. when try exmple export report, there new black window opened address mysite.com/reserved.reportviewerwebcontrol.axd... it's working fine. but.. pass axd via proxy. mean, i'd force export use url myproxy.mysite.com/reserved.reportviewerwebcontrol.axd... redirect request mysite.com/reserved.reportviewerwebcontrol.axd... i've noticed, link build within js (that inlcuded in axd): exportreport: function(format) { if (this.exporturlbase == null) return false; window.open(this.exporturlbase + encodeuricomponent(format), "_blank"); return true; }, the url axd stored in exporturlbase . how can change proxy serwer url? it possible modify exporturlbase field in javascript. report stored in placeholder somewhere on page, once found can create call _getinternalviewer() function on gain access exporturlbase. have @ following code: ...
Read more

c# - must be a non-abstract type with a public parameterless constructor in redis -

-
when save object, got below error must non-abstract type public parameterless constructor in order use parameter 't' in generic type or method 'servicestack.redis.redisclient.store<t>(t) redisclass.getinstnace().store(msg); // error here redisclass.getinstnace().save(); as third party's class, can not edit how save object? could create wrapper around third party object call constructor, store wrapper? e.g. public class mywrapper { public thirdpartyobject thirdpartyinstance { get; set; } public mywrapper() { thirdpartyinstance = new thirdpartyobject("constructors"); } }
Read more