New answers tagged

4

You put a cryptographically random, unguessable token on the password reset link that you send to the user's mailbox, and give them a time limit, expiring the link after that time limit has passed. The token insures that it came from the right mailbox. Further Reading Implementing web application self password reset mechanisms properly Forgot Password ...


8

Yes. Asp.Net Membership is a bit outdated. Asp.Net Identity was introduced a few years ago to help solve some of the pain points with the older system. It supports third party OAuth through Google (and custom OAuth providers), 2 factor authentication, and easily extending the default schema via Entity Framework code first. It's really quite nice out of the ...


0

Associate the token with the source IP address of the request in addition to the username when saving it to redis and when looking it up while authenticating a request. Remember to handle the case where you have a cookie but it doesn't match the token associated with the request's source IP address, authentication should fail in that case.


1

Caching the user/relationship data locally will certainly make your application much faster because your backend doesn't need to perform as many time-consuming queries on the facebook API on every single request. Also keep in mind this clause from the Facebook API service terms: 11.If you exceed 5M MAU, 100M API calls per day, or 50M impressions per day,...


0

Since there is no answer, I'll be bold and propose one, even though I don't completely understand your constraints. First, your question contains a mistake. It is not necessary to "buy" a security certificate. StartSSL (offered by StartCom) is free, and Let's Encrypt (https://letsencrypt.org) is free. There are others, too. But if you don't want to use TLS ...


2

First off, the token approach seems sound for your case. One option is to encrypt user information (e.g. id) into the token. On the server side, you can then keep things stateless. Realize that no matter the details of how it is generated, this token is sensitive. If someone has it, they can use it to pretend to be that user as long as it is valid (just ...


1

Don't really know the full use case but this really screams using a session to me. Normally these are implemented with a unique ID sent to the client in the form of a cookie and stored on the server in an in memory database like redis or memcached. When a user logs a new object will be added to redis and stored by a unique key with any user information ...



Top 50 recent answers are included