Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Check authorization on ALL controller actions, both GETs and POSTs. Authorize not for session, but for each request once again.</p> <p>Server validation is a must. Also enforce some amount of data integrity on the database level. Fail as soon as you detect some exceptional situation. Don't try to recover and handle all possible scenarios to please the user.</p> <p>Don't rely on user identification like username stored in cookies. It can be replaced. Add something more and unique to that. Cookies can also be stolen and transfered to another PC. Consider the option to check an IP address (for example) to get some assurance you are not tricked.</p> <p>Limit user operation amount per time unit. Don't allow to make 100 submits in a minute.</p> <p>All user inputs have to sanitized. Yes, worry about SQL injections.</p> <p>Don't store passwords in plain text. Hash them. If someone breaks into your system, they can misuse the passwords by assuming the user has the same password to access his email account, banking system etc.</p> <p>Another good idea could be not to use the public nickname, email or something else known publicly as a login name. Allow user to use a login to perform login operation, and a different name to represent them publicly on the site.</p> <p>Actually, check out this thread. It has a good summary of that kind of knowledge.</p> <p><a href="https://stackoverflow.com/questions/72394/what-should-a-developer-know-before-building-a-public-web-site">What should a developer know <em>before</em> building a public web site?</a></p>
    singulars
    1. This table or related slice is empty.
    1. POSecurity considerations for intranet developer making public facing website?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USUser
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POSecurity considerations for intranet developer making public facing website?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    1. CODoes HttpContext.User.Identity.Name look at the cookie?
      singulars
      1. PO
      1. USDan
    2. COCannot say. I do not use ASP.NET membership, but rather my own authentication/authorization implementation. If there is an option of keeping the user logged in between sessions, then there is probably a cookie in play.
      singulars
      1. PO
      1. USUser
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload