Need help w/Securing a Complete Directory

I have an application that which has a simple backend db to
"login". The URL is connected with an "https://" and it goes to the
login screen with the username and password just fine and displays
what I want. However if I copy and paste the URL into another
browser window it displays the page w/o asking for the username and
password. How do I fix this???
I also have an "error.cfm" page but it doesn't seem to work
effectively. Need help and ideas please! URL (s) in question are
listed below.
Thanks!
https://www.ext.colostate.edu/mg/staff/login/login.cfm --
Login Page -- when I enter the username and password all is good -
it display the page called.
https://www.ext.colostate.edu/mg/staff/index.cfm
now 1 of 2 issues. If I copy and paste the index.cfm page I
get your basic "error" - I have the following CFIF statement on the
index.cfm page
<CFIF IsValidLogin.Login_Match IS "0">
<CFLOCATION
URL="https://www.ext.colostate.edu/mg/staff/login/login.cfm">

<CFELSE>
<CFSET Session.LoggedIn = "1">
<CFLOCATION URL="../index.cfm">
</cfif>
2nd problem. I get into the page all is fine but if I click
on anything that is connected to a pdf, doc, etc.... and copy and
paste the URL into another browser it displays and I don't want it
to. (example:
https://www.ext.colostate.edu/mg/staff/CurrUnits/CMG/018ANS-HW-CMG.pdf)
HELP! What do I need to change. Thanks to all who respond in
advance.

"sarathy", I think (but don't quite KNOW just yet!!!) that I need to type into my browser's location bar as a part of the url for the jsp the "webapps" folder which is under the main installation for Tomcat! And, to quote your last posting to me "hey before you test your clock.jsp... can you see the examples of tomcat ?.. if not there is a problem in tomcat installation.. may be setting paths and stuff. Do you know on which port you installed ?.. the def is 8080 try http://localhost:8080/", I can answer with a resounding YES to being able to see and execute all of the various jsp and servlets, so maybe I will counter what I earlier indicated in my last post that there is something basicly wrong with my Tomcat installation, like it being installed into the wrong folder.
No, like I said up above, i think that if I only make sure I type into the web browser's location bar the "webapps" folder first, then the "jsp" folder, then finally the name of the particular jsp file which I choose to work with, then I will be quite okay on being able to consistently see my jsp whenever I want to. Please respond back to me if you agree/concur with my analysis or maybe you don't and wanna give me an alternative method of doing this. I will gladly even listen to a different approach to doing this because I am getting pretty desperate with my efforts to "get it right" with being able to execute either a jsp or a servlet.

Similar Messages

HT5621 Need help for security question. I forgot passwrd rescuee email. How to reset rescuee email?

Need help for security question. I forgot passwrd rescuee email. How to reset rescuee email?

How to reset your Apple ID security questions.
Go to appleid.apple.com, click on the blue button that says 'Manage Your Apple ID'.
Log in with your Apple ID and password. (If you have forgotten your Apple ID password, go to iforgot.apple.com first to reset your password with a password recovery email)
Go to the Password & Security section on the left side, and click on the link underneath the security questions that says 'Forgot your answers? Send reset security info email to [email]'. This will generate an automated e-mail that will allow you to reset your security questions.
If that doesn't work, or there is no rescue email link available, then click on 'Temporary Support PIN' that is in the bottom left side, and generate a 4-digit PIN for the Apple Account Security Advisor you will be contacting later.
Next, go to https://getsupport.apple.com
(If you see a message that says 'There are no products registered to this Apple ID, simply click on 'See all products and services')
Choose 'More Products & Services', then 'Apple ID'.
A new page will open.
Choose 'Other Apple ID Topics', then 'Forgotten Apple ID Security Questions'.
Click the blue 'Continue' button.
Select the contact option that suits your needs best.

Hi, I need help to secure my linksys wireless router, i tried the setup guide but i didnt work..

hello
I need help securing my linksys wireless router with speed boosters. In august me and some friends took over this rented house, and with the house we got their old internett system, we use a linksys router, This nett is open for everyone, but we want to secure it for other users. We didnt get the manual and i've tried the guide on your site but it says it cant be changed. The old owners didnt either know what to do. Is there some help i can get with this? Is there some buttom i can push to reset it and then make it possible?

Connect your computer using wire to router. Open setup page of router by typing http://192.168.1.1 in browser's address bar, and typing password as "admin" and no user name, if admin doesn't work reset router and do above step again. Go to wireless tab, here change wireless network name from linksys to any other name. Save the settings. Go to wireless security sub-tab here change security mode to WPA personal etc, and enter you secret key in passphrase/shared key, Save the settings.This secret key will be security key of your wireless network.

Need help with Security when running AS3 inside browser

Hi,
I am fairly new to flash, but a fairly experienced
programmer.
I have created a game that runs perfectly and communicates to
a WinSock server over port 4000 to publish its final score to.
Using simple XMLSocket and Send.
When I run the game in the standalone flash player everything
works perfectly as it should
However when I embed in a HTML page or similar it goes wrong.
The game works fine, but the final posting to the WinSock socket
server fails. I have retrieved the error message.
ioErrorHandler: [SecurityErrorEvent type="securityError"
bubbles=false cancelable=false eventPhase=2 text="Error #2048"]
My server is a local server to me running IIS 6. Everything
runs fine by the standalone flash player so I know ports are clear
and firewalls are not the problem.
Searching around google and forums I have found out that in
9,0,124,0 (the flash I am running) that they made some security
enhancements, namely you need to post a crossdomain file.
My file is sat in the wwwroot of my webserver where my flash
swf is hosted and looks like
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cross-domain-policy>
I have also tried adding the following to the 1st section of
the swf file
Security.loadPolicyFile("
http://mydomainname.com/crossdomain.xml");
I have tried all conbinations, but I cannot get the flash to
communicate to the socket server when it inside a web browser.
If i run it in the standalone player, everything works
perfectly.
Can someone help me please. I have been googling and ripping
my hair out for ages. This is the final stage of my project and I
am failing at the final step.
Just to add.
My server and testing computer are on the same domain, the
web server is a win2003 server and my testing and coding server is
a XP machine running IE7. They are linked by a ADSL router sharing
the same external IP address but via DHCP addressing. Everything
works fine for port forwarding of the winsocket port.
Just to emphasis, I believe this setup is correct, as it all
works fine when I run in the flash player.
Many thanks

I fixed it eventually.
In flash 9.0.124.0 they now force you to have a socket XML
server running on port 843 a server somewhere if you wish to use
XMLSocket inside a browser.
Nothing to do with domain or crossdomain.xml files.
You need to also call
Security.loadPolicyFile("xmlsocket://x.x.x.x:843") before you
open the socket.
to load in the XML that defines what is allowed.
Search google for AS3 and socket server port 843 and you will
find examples and even a simple Java based server to use.

Need help in security model !!

Hi All,
I am new to the security api-s provided by java. Can anyone tell me how I can define policy and security context in java. Is there any api for that??
Let me tell u , what exactly I need. I want to implement Role Based Access Control in my application. I want to give some privileges to my users in accesing methods of an object.How can I do that?
Thanks in advance,
Shruti

Hi All,
I am new to the security api-s provided by java. Can anyone tell me how I can define policy and security context in java. Is there any api for that??
Let me tell u , what exactly I need. I want to implement Role Based Access Control in my application. I want to give some privileges to my users in accesing methods of an object.How can I do that?
Thanks in advance,
Shruti

Need help to access the active directory

Hi.
I have WinXP and I want to connect to its active directory using JNDI to get the users informations..
I have read from sun tutorial the following :
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://localhost:389/o=JNDITutorial");
but the problem is I have never used win active directory before, so I don't
know its syntax inside my system.
what should I put instead of : ldap://localhost:389/o=JNDITutorial
to access the MS active directory ?
what should I put instead of o=JNDITutorial to access the users informations ?
should I modify com.sun.jndi.ldap.LdapCtxFactory ?
should I download LDAP server for windows ?
your help is really appreciated ....

Using SIMPLE authentication against the Active Directory, you can use either the fully distinguished name (not a relative distinguished name), a userPrincipalName or a NT Domain style name.
Eg.
"CN=John Smith,OU=IT Admins,DC=Antipodes,DC=Comor
"[email protected]"or
"ANTIPODES\jsmith"If you are using the distinguished name form, even if your initial LDAP Context URL is something like:
"LDAP://mydc.antipodes.com:389/OU=IT Admins,DC=Antipodes,DC=Com"you cannot just use the Relative Distingusihed Name (RDN) "CN=John Smith", you must use the full distinguished name:
"CN=John Smith,OU=IT Admins,DC=Antipodes,DC=Com"Regarding the userPrincipalName, even if there is no value for the userPrincipalName attribute there is an implicit userPrincipalName which is constructed from the user's samAccountName attribute (a mandatory attribute) and the dns name of the domain.
Assume the following attributes for the user object:
Distinguished Name: CN=John Smith,OU=IT Admins,DC=Antipodes,DC=Com
samAccountName: jsmith
userPrincipalName: J.Smith@IT Admins.Antipodes.Com
givenName: John
sn: Smith
displayName: Smith, John
An explicit userPrincipalName is the value stored in the user's userPrincipalName attribute.
You could then either use the explicit form "J.Smith@IT Admins.Antipodes.Com" or the implicit form "[email protected]"Even if the userPrincipalName attribute had no value, you could still use the implicit form "[email protected]" to authenticate the user.

Need help with security

Hi. I'm new to this list, and pretty new to web services. I'm
currently trying to apply security to an existing application, and
i've been studing the tutorials at sun web
(http://java.sun.com/webservices/docs/1.4/tutorial/doc/). In the
simple sample, in the build.xml file, there's a 'gen-server' target
which i believe creates ties of the service, right? Well, i do the
same step in my application (just before packaging into a raw war
file), and move all the generated files, together with my server
compiled classes, to the WEB-INF dir. Therefore i have all that class
files in /WEB-INF/classes/hello (i'm doing this with a helloword
example). Included in those files, theres a file called
"HelloIF_Tie.class", which i assume is the tie for my service, created
by the 'gen-server' target.
After this i create a raw war file using the jar tool, and take the
generated file to a dir named "dist". Then i try to create a cooked
war file using the wsdeploy tool. However when i try to run the
application, the server seems to ignore any security options i have
configured. Looking into the deployable war file i found that it had
generated quite a few more class files
(HelloIF__HelloService__Tie.class between them), and that in the
jaxrpc-ri-runtime.xml file there was the following line:
tie='hello.HelloIF__HelloService__Tie'
This seemed a bit strange to me, since i believed that my tie file was
HelloIF_Tie.class. Therefore, i tried something: changing that line
for
tie='hello.HelloIF_Tie'
And packaging all into a war file again with the jar tool, everything
runs fine. However its kind of boring doing this every time i change
the server code. So my question is...
is it possible to tell the wsdeploy tool not to generate any tie
files, and use the ones existing in the raw war file???
is there any other solution to my problem???
Im sorry if these questions are stupid, but im still quite novice with
jwsdp and i dont know if im doing things right. Thank you very much.

CQAndroid, help is here! I am familiar with this feature and use it with my own laptop and iPhone and well. It's a great feature! It forwards all of your text messages to your phone and Macbook, if you like. There's a few steps to try. First go to your iPhone Messages settings (Settings > Messages > iMessage) and turn off iMessages and turn it on again. Then go to the iMessages Settings on your Mac and do the same. Also make sure to activate your telephone number in the iMessages settings on your Mac. Try this and keep us posted please. Thanks!
KristieQ_VZW
Follow us on Twitter @VZWSupport
If my response answered your question please click the "Correct Answer" button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

Need help with security design!

Hi,
I haven't worked with security design very much. Currently I'm about to develop an application to my father which should implement some sort of security.
One of the reasons for this application besides making my father happy is educating myself.
The application is an online image album.
The security could be divided in role-based security and instance level security.
Role-based (NO PROBLEM):
A user cannot delete another user, an administrator can delete users.
Instance-level (DON'T KNOW HOW):
A user can load other users image albums if he/her is allowed/granted to view the album and its images. Note that the user could be granted to view the album, but not all of its images.
My problem is how I should design the "instance-level" security? Should I keep a ACL (Access Control List) with each instance of album and image?
This seems to be a common functionality to add view/load/read/write permissions to an instance in runtime to let a certain user to operate on an asset?
Have searched the Internet but haven't found any nice framework to help me.
Could anyone with some experience please help me out?!
Kind regards, Andreas

Hi,
I ran into the same problem. Could you resolve it?
please give me your feedback.

Need help on security projects

Hi,
we are small network providers. we supply routers, switches, firewalls and also do configurations.
now we are interested in big size projects. For that I want to know, what security projects include?
please provide me full details about security projects. If possible some real time project details.
help would be appreciated in advance.
Regards
skrao

check out the SAFE blueprints on Cisco web site.
http://www.cisco.com/en/US/partner/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_papers_list.html

WRT54GS Need help, interesting security problem

Hi All,
New to this community, so I hope that my description is understandable. Plus, I've been reading with ernest, am totally confused and wish someone could just tell me "this is how you fix this: Step 1..." but it never seems to happen that way.
1. WRT54GS Wireless Router, (not sure of the version because my setup page says one thing and the bottom says different) was originally setup with a Gateway Desktop, longer than 5 yrs ago.
2. Currently the host computer is a Dell. We have 1 wireless laptop, 2 netbooks, 1 iPod, and 2 wireless printers in a home network.
The main problem is getting online (I never know how many devices will try to do something at the same time) with the router (keeps saying that the "Security" is Open"). I've tried to setup new networks, resulting in the same problem. Is it possible to just remove the Dell from the network or could the wireless laptop become the host computer? And could someone explain to me how to do that? The last time I tried to change the security on the router, (I believe that WEP is what the Dell set it at and I was trying to change it to a higher level), I got a notification that not all the devices were the same, security could not be changed. Help, I just want us all to be able to use a secure network!!

Melinda613 wrote:
1. WRT54GS Wireless Router, (not sure of the version because my setup page says one thing and the bottom says different) was originally setup with a Gateway Desktop, longer than 5 yrs ago.
If you are not sure of the version why don't you post what is printed on the bottom and what is shown on the setup page?
Melinda613 wrote:
2. Currently the host computer is a Dell. We have 1 wireless laptop, 2 netbooks, 1 iPod, and 2 wireless printers in a home network.The main problem is getting online (I never know how many devices will try to do something at the same time) with the router (keeps saying that the "Security" is Open"). I've tried to setup new networks, resulting in the same problem. Is it possible to just remove the Dell from the network or could the wireless laptop become the host computer? And could someone explain to me how to do that? The last time I tried to change the security on the router, (I believe that WEP is what the Dell set it at and I was trying to change it to a higher level), I got a notification that not all the devices were the same, security could not be changed. Help, I just want us all to be able to use a secure network!!
Where does it say "security is open" exactly? What page? Where? When?
Go to the setup page of the router. Wireless and Wireless Security. Post your current settings on those two pages. That will show how your wireless is configured.
We'll take it from there...

HT204266 Apple I Need Help (We could not complete your request. There was an error in the App Store. Please try again later. (100)

I Want To Download Paid Apps It Says (We could not complete your request. There was an error in the App Store. Please try again later. (100)
What Should I Do Tell Me Please I Went To Youtube To Find Any Tutorial And Its All Just CRAP So Please Give Me A Solution
Today Sunday 14 2013 I But To 10 doller Gift Cards And I wanted To Download Grand Theft Auto:San Andreas And It Said First Click OK to confirm that you are 17 or over. Your content will then begin downloading immediately. i Clicked Ok Then It Said
(We could not complete your request. There was an error in the App Store. Please try again later. (100)
Then It Said For assistance, contact iTunes Support at www.apple.com/support/itunes/ww/
And I went To The Link and it Said Nothing About Error 100 Soo I Dont Now What To Do One Of The Tutorials Said That You Have To Agree To The Terms And Conditions Soo I Found The Terms And Conditions At Itunes The App That Comes Allready Installend On Your MacBook Pro At The Bottom Left And When I Clicked On It It Got Me To A Link To Your Website And The Terms And Conditions You Cant Agree Just Read Them ONLY You Cant Agree Soo Apple
PLEASE TELL ME

Error
what is error code 1009?

Need help with security error

com.ms.security.SecurityExceptionEx[staff4 init]; cannot access file treble.gif
treble.gif is a small picture that appears in the applet.
I put it in the same folder as everything else and
it works fine in applet viewer
what could the problem be?

perfect again
thanks so much KP
I swear that the only two methods the java tutorial suggests are
myImage = getImage(URL); //in a method in an Applet subclass only
or
myImage = Toolkit.getDefaultToolkit().getImage(filenameOrURL);
no mention of getDocumentBase()....hrmm
anyway, if you wanna see my baby check her out
ashonline.com/anotherband/misc/staff4

Need help finding security App

Hi everyone, I just bought the Droid Charge by Samsung and I have been researching the various security Apps but I still have questions. The security application that Verizon is prominently supporting, Good(product name), is one of the few (the only one I've found) that encrypts its data. Everyone else touts their firewalls and virus protection which is nice but they don't say anything about encryption. Does anyone know of a product out there that has encryption, a firewall and virus protection? Does anyone know how much the Good App costs? ALSO, is the Droid Charge considered a Google Android? Thanks.

should be built into the Charge for encryption if you updated to the latest version(EP4).
Samsung FAQ
Yes it is an Android device .

Need help getting files names from directory

I have never done anything in php before and I'm struggling.
In an attempt to search through potential document names in a directory, I've added the following code to a new php document:
<?php
if ($handle = opendir('.')) {
    while (false !== ($file = readdir($handle))) {
        if ($file != "." && $file != "..") {
            echo "$file\n";
    closedir($handle);
?>
with no luck. When executed all I get is a blank screen. Any ideas why?
End goal is to list the file names in the directory so that the user can choose to open desired document. Thanks!

Click here and pick the option which best fits your situation.
(93771)

Need help understanding security scan results.

My agency recently started using HP's Fortify Scan tool, which is designed to scan CF code directly, rather than the rendered page. The scanner always seems to flag our pages for a certain error when I use the following code (used to create a PDF on the fly):
<cfheader name="Content-Disposition" value="attachment;filename=#pdffile#">
<cfcontent type="application/octet-stream" file="#expandPath('.')#\#pdffile#" deletefile="Yes">
01. is line 299 in my code.
I'm basically generating a filename elsewhere on the page that's based on what a user is requesting, then using the code above to create a downloadable PDF of that file.
The error is:
Header Manipulation (Input Validation and Representation, Data Flow)
The file myfile.cfm includes unvalidated data in an HTTP response header on line 299. This enables attacks such as cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation or open redirect.
I'm thinking there's one of two potential issues.
expandpath() is exploitable
The scanner is programmed to flag any variable passed to a cfheader tag.
Any thoughts?

You need to scope the pdffile variable. Without a specific scope it could be overwritten by incoming url or form variables. I would try that then run the scan again.
HTH,
--Dave

Need help w/Securing a Complete Directory

Similar Messages

Maybe you are looking for