.net - How do I encrypt session data into a token to authorize subsequent web service calls? -

-

i have web service needs protected unauthorized users. need expose web service operation authorize user, based on username , password. response user validation request should contain security token. security token contains embedded user properties client applicatino can use, when encrypted, used authenticate subsequent web service operations. unencrypted token looks this:

uid=444; dte=2012-06-01t14:01:54.9571247z; gid=1; wid=00:1c:b3:04:85:11; sid=lit3py55t21z5v55vlm25s55;

i can use symmetric key algorithm key can shared secret between client , server (i control both). have implemented following rijndael example using sha1 , key size of 256.

this code often quoted across internet, microsoft themselves, state in relation rijndael:

the rijndael class predecessor of aes algorithm. should use aes algorithm instead of rijndael. more information, see entry the differences between rijndael , aes in .net security blog.

are there security concerns should have? if so, how change example code, or can provide better, more secure example?

finally, alternative, considering using windows azure access control service issue security tokens against own identity provider, , using token user account data separate call. since application running in azure, better implementation? share experience of using acs such architecture?

btw: client application ios 5.

instead of building use formsauthentication.encrypt method. method encrypt , sign formsauthenticationticket (this 'ticket' can contain username additional information). signing ticket prevents tampering (this based on machine key).

the encrypted ticket string send mobile device. then, each other request send token , decrypt server side. that's authentication part.

now, if want send encrypted data client suggest transfer data on https (the same applies token).

reference: http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.encrypt.aspx


Comments

Post a Comment

Popular posts from this blog

django - How can I change user group without delete record -

-
on website user have 1 group. , user can change group. it's made user.groups.clear() and user.groups.add(new_group) but it's not efficient, because there 2 sql query: delete, insert. how can change group update query? user , group related each other using manytomanyfield . means intersection table exists relating both entities, , if don't specify model map (using through attribute) django creates 1 you. looking @ sources django.contrib.auth.models see that's case. fortunatly, can access intermediary model using through attribute of manager (in case, user.groups.through ). can use regular model. example: >>> alice = user.objects.create_user('alice', 'alice@example.com', 'alicepw') >>> employee = group.objects.create(name='employee') >>> manager = group.objects.create(name='manager') >>> alice.groups.add(employee) >>> alice.groups.all() [<group: employee...
Read more

java - Need to add SOAP security token -

-
i need set custom soap header attribute on jax-ws generated webservice client. case webservice calls must go through proxy server requiring specific token (recieved web request header) present in soap request header. e.g.: 1 carserviceservice service = null; 2 service = new carserviceservice(new url(url), new qname(qname); 3 carserviceendpoint port = service.getcarserviceport(); it seems in line 3 wsdl retrieved , call fails due missing security token. 1 point direction on how done? a detailed example has been mentioned here: creating , deploying jax-ws web service on tomcat 6 this article shows how create , use security token .
Read more

java - EclipseLink JPA Object is not a known entity type -

-
i have strange problem eclipselink , object want persist. have 1 object (keypointlistimpl) stores object keypointimpl in list. persisting keypointimpl objects works great if try persist keypointlistimpl object java.lang.illegalargumentexception says object keypointimpl isn't known entity type. here keypointimpl code: @entity @table(name="keypoints") public class keypointimpl implements keypoint { @id @generatedvalue(strategy = generationtype.identity) private int id; @enumerated(enumtype.string) private detectortype keypointtype; private float x; private float y; private float size; private float angle; private float response; private int octave; private int classid; ... } here keypointlistimpl code: @entity @table(name="keypointlists") public class keypointlistimpl implements keypointlist { @id @generatedvalue(strategy = generationtype.identity) private int id; @onetoone(cascade={ca...
Read more