I'm using Delphi XE11 to develop a small application to retrieve info from a password protected website.
So far I have placed a TWebBrowser on a form and use "Navigate" to load the page. After I login with my credentials, I create a filter on the webpage.
I have successfully parse all the pages that result from filter and saved on the disk useful information.
The link are like this:
"https://membri.listafirme.ro/pagini/p1.htm#selectie"
"https://membri.listafirme.ro/pagini/p2.htm#selectie"
"https://membri.listafirme.ro/pagini/p278.htm#selectie"
Now my problem is that when I want to use the same component to navigate (in the same session I believe) on one link that exist on the page, is navigate on a page without credentials and therefore with partial information.
Is there a way to pass the credentials?
Or what to do to stay logged?
I'm a loosing the session?
tks alot
Razvan
Related
I am using Durandal, knockout to create a Single Page Application. I need to do following (two pretty simple things):
Show/hide widgets that are only for administrator, based upon the user's authorization,
Change menu options based upon whether user is authenticated or not (for anonymous show - login/sign up and when authenticated show "Welcome .." .
If this was a regular MVC4 application I would have done it using
#if (User.Identity.IsAuthenticated) { ... } check in razor views, but with views in durandal this is ruled out.
I want to avoid putting sensitive business logic in javascript - user need not know what kind of options could have been available to him if he was an administrator.
What's the best way to achieve this in Durandal & Knockout? I have been coding so far using classic ASP.NET and lately using ASP.NET MVC. Developing SPA using Durandal is a new game for me...If anyone can give me only steps/pointers to do this that will help a lot too..thanks in advance!
The way I do it.
My menus are build inside a menubar.js file. The menuItems are observableArrays([]) initially and I subscribe to a topic "user-logged-in".
When the user logs in, I get the user's permissions/roles and store them locally in storage. and then send out notification "user-logged-in" with the user data.
My menubar recieves the notification, checks the permissions/roles and adds various menu items appropriately.
the shell.html has a view composition for the menubar.js. So if there are menuitems, it shows up, else it does not. so when the user logs in, the menuItems are populated and at this point the menu items show up.
When the user logs out, I clear the local storage cache and send out a message "user-logged-out".
The menubar.js recieves this message and clears it's menu items, essentially clearing the menu on the menubar.htm
You can essentially do the same for the widgets and use a visible binding to a property which hides or shows for a particular permission/role.
Also important is router.guardRoute. read up on this so that people cannot directly go to a route without logging in.
Hope that helps
I am working on a POC (proof of concept) where I am evaluating Orbeon form builder/runner. I am using community edition, just in case, I will need to change the code, else the Professional Edition would do for POC.
I am integrating FormRunner with my web application running on different web server, which will call the FormRunner URL with some custom query parameters.
I want to remove the Summary, PDF and Review buttons from FormRunner and simply want the save button to function as submit button, so as clicking on it will submit the POST data to my custom Java code which will talk back to my web application, likely through REST API. The submit button then should redirect me to another page saying 'Your data has been submitted'.
I find it difficult to understand the area where I can change the code for expected behavior. Could you provide me some pointers in this regards please?
Thanks and Regards,
Mayuresh.
You shouldn't have to change the code for this, but instead use the oxf.fr.detail.buttons.*.* property to define which buttons are shown. Based on your description, you only need the workflow-send button, which, amongst other things can POST the form data to a service you specify.
what design approach would you take for security and scalability (and perhaps level of effort) when posting an ASP.NET MVC HTML form that also has a Flash component, as described in the scenario below?
I have a scenario where there's an ASP.NET MVC site, and a page that requires user authentication & authorization to access (using ASP.NET forms authentication). On that page there's an HTML form. The form also has a Flash component. The form has a few text fields, and the Flash component has binary data that needs to get submitted to the server in tandem with the HTML form fields. When the user hits the submit button on the HTML form, the form contents and binary data from the Flash need to get submitted as part of one atomic unit, so to speak.
I know that I can use HTML / Flash JavaScript bridging to post the form either through JavaScript, or through the Flash component. I could even do both, perhaps posting the binary data from the Flash component when the user clicks submit, and then posting the HTML form content following that.
From your experience, what approach would be the path of least resistance to post the form with? Considering the user authentication and authorization part, I imagine that Flash would higher effort than HTML. What about the user authentication aspect? If the page posted from Flash to the server, would Flash also have to authenticate the user, in addition to the standard HTML authentication form?
My Flash binary data should not typically be greater than 300KB, often less...any opinions / insights are greatly appreciated!
EDIT:
I also vaguely remember that with Flash 10.1, ExternalInterface seemed to not work right when transferring binary data to JavaScript, am I mistaken with that, and that you can easily transfer 300KB or more of binary data from Flash to a JavaScript variable that is then posted to the server?
Thanks!
That's one way of doing it:
Make your flash component call a javascript function through ExternalInterface.call().
Make the called javascript function change a hidden field inside the form.
When the form is posted, the hidden field will send the desired value to the server.
I guess this is also the safest way - since the Flash component will not communicate with the server. Everything you need is a standard, non-AJAX form post.
Edit
Sorry, I guess I should have paid more attention... If there is too much data being sent from the flash component, maybe you should post it directly to the server.
Still, you could use ExternalInterface to synchronize the whole process. Make Flash call a server-side method (I would use FluorineFX for that, but your opinion may vary). Then .NET will return an ID, meaning it has received and saved the binary data for future use. Then call ExternalInterface to set that ID to a hidden field. After that, when the HTML is posted to the server, the server-side action method just need to retrieve the binary data using the posted ID...
The problem here is that you will end up with some binary data that will never be associated to any form post... But that's OK I guess, just run some "garbage-collector" script from time to time.
About the authentication issue: FluorineFX does implement .NET authentication, and it is able to retrieve the current logged in user. Of course, there are some issues.
I've noticed on viewing the source of my Rails app that a lot of information is publicly available that shouldn't be - specifically a Google Analytics script that contains my GA account number, and the authenticity tokens for my forms.
Are there any guidelines on hiding this kind of code in the source?
Your Google Analytics ID and the authenticity token both need to be available for the browser to do it's job. They don't need to be hidden. There is no security risk associated with letting a user see them.
If by "view source" you mean the HTML returned from the server, then no. There are services and products that will encode your page and make it difficult to decipher, but it's never impossible as your browser will ultimately have to do it in order to render the page. Most of these page encryptors, as they are sometimes called, will make your site impenetrable to search engines since they won't run your JavaScript before indexing the page.
Have a look at other sites and you'll see it's fairly common practice to leave this sort of stuff open since the time and effort involved in obscuring or hiding it is a waste of time. So long as you're not revealing any sensitive information inadvertently, like your Amazon S3 account keys or the secret used for encrypting your session, which is unlikely to happen by accident, then you'll be fine.
Think about it for a moment, though. Without the browser having access to your Google Analytics account number, how would the Google script know which account to track against?
I don't think it's dangerous to have your authenticity token there. In order to see that authenticity token, a user has to be logged in. It doesn't matter if that user has the authenticity token for that session or not. It should expire when the user logs out.
However, it is possible to hide these things from the source if you want to (although they'll still be available if you have Firebug or a similar utility).
For your GA script, you could consider it a resource. Your application.js (or some other included js file) could make an AJAX call to the controller (the request header has to accept javascript) and your controller could send back a js.erb file that has the script included. This js is now only visible in Firebug if you look at the response to the request to the controller. You will not see it in the source.
For the authenticity token, you can do something similar. I've created a JavaScript form builder in one of my apps. This form builder is a resource which is once again retrieved through an AJAX call and sent down as js.erb. The js.erb file has a FormBuilder constructor. Within that constructor, there is a builder.form() function which does this:
return $('<%= form_for #object do |f| %> <% end %>');
That will return a jQuery object which contains a Rails form with the authenticity token and all the other goodies.
If you want your JS form builder to do more than just spit out a form (e.g. dynamically create properties for the builder object based on the object's attribute names which contain inputs, checkboxes, and collections for the corresponding attributes), talk to me and I can tell you how I did that too :)
I'm making my way into web development and have seen the word postback thrown around. Coming from a non-web based background, what does a new web developer have to know about postbacks? (i.e. what are they and when do they arise?)
Any more information you'd like to share to help a newbie in the web world be aware of postbacks would be most greatly appreciated.
The following is aimed at beginners to ASP.Net...
When does it happen?
A postback originates from the client browser. Usually one of the controls on the page will be manipulated by the user (a button clicked or dropdown changed, etc), and this control will initiate a postback. The state of this control, plus all other controls on the page,(known as the View State) is Posted Back to the web server.
What happens?
Most commonly the postback causes the web server to create an instance of the code behind class of the page that initiated the postback. This page object is then executed within the normal page lifecycle with a slight difference (see below). If you do not redirect the user specifically to another page somewhere during the page lifecycle, the final result of the postback will be the same page displayed to the user again, and then another postback could happen, and so on.
Why does it happen?
The web application is running on the web server. In order to process the user’s response, cause the application state to change, or move to a different page, you need to get some code to execute on the web server. The only way to achieve this is to collect up all the information that the user is currently working on and send it all back to the server.
Some things for a beginner to note are...
The state of the controls on the posting back page are available within the context. This will allow you to manipulate the page controls or redirect to another page based on the information there.
Controls on a web form have events, and therefore event handlers, just like any other controls. The initialisation part of the page lifecycle will execute before the event handler of the control that caused the post back. Therefore the code in the page’s Init and Load event handler will execute before the code in the event handler for the button that the user clicked.
The value of the “Page.IsPostBack” property will be set to “true” when the page is executing after a postback, and “false” otherwise.
Technologies like Ajax and MVC have changed the way postbacks work.
From wikipedia:
A Postback is an action taken by an
interactive webpage, when the entire
page and its contents are sent to the
server for processing some information
and then, the server posts the same
page back to the browser.
Expanding on the definitions given, the most important thing you need to know as a web-developer is that NO STATE IS SAVED between postbacks. There are ways to retain state, such as the Session or Viewstate collections in ASP.NET, but as a rule of thumb write your programs where you can recreate your state on every postback.
This is probably the biggest difference between desktop and web-based application programming, and took me months to learn to the point where I was instinctively writing this way.
Postback happens when a webpage posts its data back to the same script/dll/whatever that generated the page in the first place.
Example in C# (asp.net)
...
if (!IsPostback)
// generate form
else
process submitted data;
Web developement generally involves html pages that hold forms (<form> tags). Forms post to URLs. You can set a given form to post to any url you want to. A postback is when a form posts back to it's own page/url.
The term has special significance for ASP.Net WebForms developers, because it is the primary mechanism driving a lot of the behavior for a page — specifically 'event handling'. ASP.Net WebForms pages have exactly one server form which nearly always posts back to itself, and these postbacks trigger execution on the server of something called the Page Lifecycle.
The term is also used in web application development when interacting with 3rd party web-service APIs
Many APIs require both an interactive and non-interactive integration. Typically the interactive part is done using redirects (site 1 redirects a user to site 2, where they sign in, and are redirected back). The non-interactive part is done using a 'postback', or an HTTP POST from site 2's servers to site 1's servers.
When a script generates an html form and that form's action http POSTs back to the same form.
Postback is essentially when a form is submitted to the same page or script (.php .asp etc) as you are currently on to proccesses the data rather than sending you to a new page.
An example could be a page on a forum (viewpage.php), where you submit a comment and it is submitted to the same page (viewpage.php) and you would then see it with the new content added.
See: http://en.wikipedia.org/wiki/Postback
Postback refers to HTML forms. An HTML form has 2 methods: GET and POST. These methods determine how data is sent from the client via the form, to the server. A Postback is the action of POSTing back to the submitting page. In essence, it forms a complete circuit from the client, to the server, and back again.
A post back is anything that cause the page from the client's web browser to be pushed back to the server.
There's alot of info out there, search google for postbacks.
Most of the time, any ASP control will cause a post back (button/link click) but some don't unless you tell them to (checkbox/combobox)
Yet the question is answered accurately above, but just want to share my knowledge .
Postback is basically a property that we can use while doing some tasks that need us to manage the state of the page, that is either we have fired some event for e.g. a button click or if we have refreshed our page.
When our page loads for the very first time , that is if we have refreshed our page, at that time postback-property is false, and after that it becomes true.
if(!ispostback)
{
// do some task here
}
else
{
//do another task here
}
http://happycodng.blogspot.in/2013/09/concept-of-postback-in.html