Tag Info

New answers tagged

0

The only way to fix this is to enforce role-level or item-level authorisation for each of your actions. Your assumptions must be: That every url to your site is known, as they all follow a predictable template That obfuscation does not matter - at some point a post will send the id, obfuscated, or substituted or not, so it is possible to predict any id ...


1

Your question seems to be about keeping files secret for security reasons, not for intellectual property protection reasons. You should not be worried about sharing your files, especially your membership provider code. If you have custom built a membership provider, then it is especially important that you let other people review it for potential security ...


3

From the description you have mentioned it seems that you are talking about a security vulnerability which is popularly know as Insecure Direct Object Reference. To mitigate this kind of issue, you should Check for the user whether he have access to particular resource or not. Base64 encoding the URL will not work in this. I would to recommend you to go ...



Top 50 recent answers are included