0
votes
0answers
29 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
1
vote
3answers
225 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
1
vote
2answers
219 views

Best way of storing a small number of user credentials

I'm working on a messaging application, based on a server/client architecture. Now I am thinking about the way how to store the user credentials. It's not a huge number, just about 20 entries with ...
1
vote
0answers
55 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
2
votes
1answer
163 views

Standard ways of revoking user access to a site

I'm in the process of building a .NET MVC website where a requirement is that admin users should be able to lock accounts to not only prevent future log-ins but to also immediately revoke access to ...
3
votes
1answer
951 views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
2
votes
3answers
645 views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
3
votes
2answers
1k views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
0
votes
4answers
2k views

Application connecting to database server

I'm working on an application which requires user credentials and so on. So a database is required on the backend. What is the best practice to connect to a database without hardcoding your password ...
9
votes
2answers
383 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
11
votes
3answers
4k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
-1
votes
1answer
828 views

How you handle security/permission in enterprise app nowadays (mid 2011)? [closed]

what you people use to handle security issues, different security rules, permissions etc. Possible answers: 1) Security framework like Rhino security or any other. (pros/cons?) 2) Custom solution ...
3
votes
1answer
2k views

How to generate nonce for Ajax web requests

As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...