Category Archives: Uncategorized

…and really just a test of LiveWriter… (which works really well)

I just came across this blog entry from Martin. Seems that on Vista the functionality for setting ACLs on URIs for HttpListener is now included in netsh (makes sense). Netsh allows to simply specify the account name and doesn’t force you … Continue reading →

I get this question from time to time. Most often because you have to set ACLs on the private key file to allow access for worker process accounts. There is no clean way to do that in managed code. The … Continue reading →

Joe Kaplan finally has a blog. He is the author of this great book and you can find a lot of useful LDAP/AD and ADFS related content on his brand new blog. http://www.joekaplan.net/  

OK – that’s the last book related post for now – if you think this information is useful and you want it at the earliest possible date – you can pre-order here or here :) Appendix A: Building a Custom Protected Configuration … Continue reading →

– What is Input?– The Need for Input Validation  – The Data/Control Channel Problem    – SQL Injection, Cross Site Scripting, Directory Traversal– Input Validation Techniques  – Black Listing  – White Listing    – Data Type Conversion    – Regular Expressions    – XML … Continue reading →

the biggest chapter in the whole book… Fundamentals – Terminology– Application Design (Trusted Subsystem vs Impersonation/Delegation)– ASP.NET Security Pipeline and Infrastructure  – IPrincipal and IIdentity  – Role-based Authorization (programmatically vs declarative)– Server Authentication Using Windows Accounts – IIS Authentication Methods (Basic, … Continue reading →

Finally! I shipped the complete manuscript to MS Press on Monday….The final book is supposed to hit the shelves in October. With that much spare time, I am almost bored now….  

While working through the ASP.NET security reference implementation (which is good work btw), the following guideline caught my attention: “Additionally, all calls to DataBinder.Eval() have been removed. While Eval is sometimes safe to use on purely static data, it is … Continue reading →

This question was asked by Scott recently. Short answer: you can :) The trick is to do a Response.Redirect with an appended query string in the following format: ~/Page.aspx?{0}={1} where {0} = forms ticket name{1} = encrypted forms ticket string … Continue reading →