asp.net - Can the EVENTVALIDATION field be tampered with? -

asp.net - Can the EVENTVALIDATION field be tampered with? -

Is it possible to decode, and it is possible to tamper with the _EVENTVALIDATION field sung in this way? I have got a lot of information about this, but in reality it is not possible to say that the value has been protected from tampering or not. I tried to decode the base 64 and got me reciprocated, so I'm assuming that it is actually encrypted, but if someone knows something and can verify it, then it will be awesome.

I know the viewer is not encrypted (although you can set it). I am not interested in that, I am only interested in eventuality.

I got a similar question: but there was no specific answer about any incident verification field.

Concrete example: I have a dropdown of available reports that the user can run, it has populated with some "members" reports, but some "admin only" reports that are provided during onload, And only connects them if the user is an administrator. When the page is posted back, can I trust the event verification fate to be safe and the user has not done the "only admin" report in the list of acceptable values, or to confirm it in my postback handler Should the user be able to re-examine the actual report that was selected?

First of all, event validation is a backstop protection against XSRF, not against malicious users

If you want to make sure that they can only run reports that they have permission to run, check that they are allowed to run the report at which point you run it Are there.

Second, the event verification data is encrypted and there is a Mac in it to be very hard to tamper with, but trusting it is not the right way to solve your problem.

03:22

Comments

Post a Comment

Popular Posts

r - Plot correlation matrix into a graph -

I have a matrix with some correlation values. I now want to plot in that graphic which is more like this or Looks less: Library (Latis) # Horizontal and vertical axis information please take- c (div class = "post-text" itemprop = "text"> "214", "215", "216", "224", "211", "212", "213", "223", "226", "225") & lt; - Paste ("DM1- ", Hor, sep =" ") # counterfeit co Relation matrix narokol & lt; (I 1: nrowcol) for core [i] - length (var) core & lt; - matrix (runif (nrowcol * nrowcol, min = 0.4), nrow = nrowcol, ncol = nrowcol (Color, "blue", "yellow"), space = "RGB"), levelplates (core, main = "dimnames = list (hor, ver)), I] = 1 # plot rgb. Stage 12-14 array correlation matrix ") Xlab =" ", ylab =" ", col.regions = rgb.palette (120), cut = 100, at = seq (0,1,0.01)) ...

Integrate flash games in android app? -

3 is a flash game that I want to integrate into a menu / list in the Android app. So when the user selects the game from the list, the game starts with the help of the Android Flash Player. Is it better or better with webwave? Is there any good tutorial? Thank you! Adobe Flash provides a good way: you can create a breeze for the Android app. Use this to create your menu and compile three games in your air app. Here are some tutorial links about how to publish AiI for Android applications and: PART1: AIR for Android, PART2: Publication for Android apps: Ai: I do not believe that the Android Flash Player can be launched with a single intention so far, so using Java Android will not solve it (now ) And and a third approach Whatever you mentioned, it should work - using the webwave.

asp.net - RegisterUser: CreateUserWizardStep -

When using CreateUserWizardStep to register a new user I'm having a problem. Help me solve this problem.I have tried to configure in the web. Provider tag for configuration & lt; Required question and answer = "wrong" & gt; Although it still does not work ... I'm using the MySQL database RegisterUser :. An IEditableTextControl is not included with the CreateUserWizardStep.ContentTemplate ID question for the security question, it is necessary that your membership provider needs a question and answer. Source error: An unrestricted exception occurred during the execution of existing web requests. Information about the origin and location of the exception can be identified using the exception stack trace below. Stack trace:. [HttpException (0x80004005): RegisterUser: CreateUserWizardStep.ContentTemplate does not include questions IEditableTextControl security question with the ID, it is necessary to require a question and answer your subscri...

Powered by Blogger