There is a vulnerability in SSL3 called POODLE, it is documented in detail here by Google. SSL2 & 3 needs to be disabled in the client browser and on the web server. Below is a registry file that can be copied and run on a Microsoft IIS web servers to disable SSL 2 & 3… Read More »
It is important to realize that although a website might be running under HTTPS it does not guarantee that the session information is not accessible from normal HTTP requests. When a session cookie is generated it is important to make sure that the cookie can only be transmitted over a secure HTTP connection (HTTPS).
Been bashing my head against this (WIF: ID1014: The signature is not valid. The data may have been tampered with) problem now for about a week. WIF tracing has been useless in trying to solve this. For my own sanity sake, here are the possible causes that I have found so far that could cause it.
So what is this OAuth? This is what wikipedia says: OAuth is an open standard for authorization, commonly used as a way for Internet users to authorize websites or applications to access their information on other websites but without giving them the passwords.[1] This mechanism is used by companies such as Google, Facebook, Microsoft and… Read More »
In the following example i will show how to build an Identity Provider also called a passive security token service (IP-STS) that issues tokens using WS-Federation. This post builds on work done in a previous post, Create your own active STS. In this article I will show how to create a complete working example of an… Read More »
Figured that I would start a post dealing specifically with all the terms we find in the Identity world. Ill add to this post as time goes on…
I created a windows forms application sample that can assist with decoding to FedAuth tokens captured from tools like Fiddler, source is included. It is downloadable from this link.
Where does architecture start? Something that is always present in the role of architect is that of project management. Architecture should start at the executive level of a company where the strategy (“what”) is discussed. That mean the top most architect reports to the executive, you may have domain expert architects placed within diffrent departments.… Read More »
Today I had an interesting situation. I had the need to see the requests and responses internal to my Asp application. Now normally one can use fiddler to see the requests and response to your application but how does one see http requests that the application might be making internally between itself and other components? After… Read More »
How to become a software architect? How to guide your career? No one can explain this better than Juval Lowy. No one is going to make you a architect. It is something you have to chase, align your life, your career and focus on becoming an architect.
As in .net framework it is just as important to add security headers to your asp.net core project to harden the security posture of your web application.
In this article i will touch on the areas that need to be configured for transactions in WCF. I will also discuss the attributes and attempt to explain how each one might affect the other. So lets start, what is transaction?
I always introduce myself as person with software engineering background. What do I mean with being a software engineer?
Back story Hi, please bear with me on this long blog post. There is lots to explain and the topic is not a easy one. In the last 3 months my team and I struggled with a problem in our SOA solution. We have a business requirement that requires that we need to service 250 concurrent connections… Read More »
The “Keyset does not exist” error occurs when a process is trying to manage the private keys of a certificate but the process does not have permission to do so.