Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Saturday, March 31, 2012

There is a problem with your selected data store

Hi,
I am using SQLServer 2005.I have created a simple website and i am trying
to membership to this.so when i click on 'Security' tab of the "WAT" tool it
s
showing the following message.
There is a problem with your selected data store. This can be caused by an
invalid server name or credentials, or by insufficient permission. It can
also be caused by the role manager feature not being enabled. Click the
button below to be redirected to a page where you can choose a new data stor
e.
The following message may help in diagnosing the problem: Unable to connect
to SQL Server database.
Is there anyway out of this?
Pls pls pull me out of this.
Regards,
SSREDDI.I had faced the same prob. but am not able to do that
this link helped me a little but. may be this may help u better.
http://www.c-sharpcorner.com/Upload...hipService.aspx
Hi Sravan,
Thank you for the information.I already tried this.I know this
works.My concern is that i dont want to use aspnet_regsql.exe.Anyway thanks
for the info.
"sravan_reddy001" wrote:

> I had faced the same prob. but am not able to do that
> this link helped me a little but. may be this may help u better.
> http://www.c-sharpcorner.com/Upload...hipService.aspx
>
u try editing the web.config file...
there is lot more to do with that..
hav u created ur own database for your application. If so you have to
give the connection string for that database.
This is my webconfig file. see this and try. I tried for about 3 days
to that.
if u didn't include the roleManager then we can't create the roles and
it states and error message saying "website not configured to enable
roles"
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/
v2.0">
<appSettings/>
<connectionStrings>
<add name="MySqlProviderConnection"
connectionString="server=localhost;integrated security =
true;database=aspnetdb" />
</connectionStrings>
<system.web>
<!--
Set compilation debug="true" to insert debugging
symbols into the compiled page. Because this
affects performance, set this value to true only
during development.
-->
<compilation debug="true"/>
<authorization>
<deny users="?"/>
</authorization>
<membership defaultProvider="MySqlMembershipProvider">
<providers>
<add connectionStringName="MySqlProviderConnection"
enablePasswordRetrieval="false"
enablePasswordReset="true" requiresQuestionAndAnswer="true"
applicationName="/" requiresUniqueEmail="true"
maxInvalidPasswordAttempts="5"
passwordAttemptWindow="10" name="MySqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
minRequiredPasswordLength="6"
minRequiredNonalphanumericCharacters="0" />
</providers>
</membership>
<roleManager enabled="true" defaultProvider="SqlRoleProvider">
<providers>
<clear />
<add applicationName="MyAppName"
connectionStringName="MySqlProviderConnection"
name="SqlRoleProvider"
type="System.Web.Security.SqlRoleProvider" />
</providers>
</roleManager>
quote:
Originally posted by ssreddi
Hi,
I am using SQLServer 2005.I have created a simple website and i am trying
to membership to this.so when i click on 'Security' tab of the "WAT" tool it
s
showing the following message.
There is a problem with your selected data store. This can be caused by an
invalid server name or credentials, or by insufficient permission. It can
also be caused by the role manager feature not being enabled. Click the
button below to be redirected to a page where you can choose a new data stor
e.
The following message may help in diagnosing the problem: Unable to connect
to SQL Server database.
Is there anyway out of this?
Pls pls pull me out of this.
Regards,
SSREDDI.

There is a problem with your selected data store

Hi,
I am using SQLServer 2005.I have created a simple website and i am trying
to membership to this.so when i click on 'Security' tab of the "WAT" tool its
showing the following message.

There is a problem with your selected data store. This can be caused by an
invalid server name or credentials, or by insufficient permission. It can
also be caused by the role manager feature not being enabled. Click the
button below to be redirected to a page where you can choose a new data store.

The following message may help in diagnosing the problem: Unable to connect
to SQL Server database.

Is there anyway out of this?

Pls pls pull me out of this.

Regards,
SSREDDI.I had faced the same prob. but am not able to do that

this link helped me a little but. may be this may help u better.

http://www.c-sharpcorner.com/Upload...hipService.aspx
Hi Sravan,
Thank you for the information.I already tried this.I know this
works.My concern is that i dont want to use aspnet_regsql.exe.Anyway thanks
for the info.

"sravan_reddy001" wrote:

Quote:

Originally Posted by

I had faced the same prob. but am not able to do that
>
this link helped me a little but. may be this may help u better.
>
http://www.c-sharpcorner.com/Upload...hipService.aspx
>
>


u try editing the web.config file...

there is lot more to do with that..
hav u created ur own database for your application. If so you have to
give the connection string for that database.

This is my webconfig file. see this and try. I tried for about 3 days
to that.

if u didn't include the roleManager then we can't create the roles and
it states and error message saying "website not configured to enable
roles"

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/
v2.0">
<appSettings/>
<connectionStrings>
<add name="MySqlProviderConnection"
connectionString="server=localhost;integrated security =
true;database=aspnetdb" />
</connectionStrings>
<system.web>
<!--
Set compilation debug="true" to insert debugging
symbols into the compiled page. Because this
affects performance, set this value to true only
during development.
-->
<compilation debug="true"/>
<authorization>
<deny users="?"/>
</authorization>
<membership defaultProvider="MySqlMembershipProvider">
<providers>
<add connectionStringName="MySqlProviderConnection"
enablePasswordRetrieval="false"
enablePasswordReset="true" requiresQuestionAndAnswer="true"
applicationName="/" requiresUniqueEmail="true"
maxInvalidPasswordAttempts="5"
passwordAttemptWindow="10" name="MySqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
minRequiredPasswordLength="6"
minRequiredNonalphanumericCharacters="0" />
</providers>
</membership>

<roleManager enabled="true" defaultProvider="SqlRoleProvider">
<providers>
<clear />
<add applicationName="MyAppName"
connectionStringName="MySqlProviderConnection"
name="SqlRoleProvider"
type="System.Web.Security.SqlRoleProvider" />
</providers>
</roleManager>

Saturday, March 24, 2012

This page contains both secure and non secure items.

Hi,
My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
shows this security alert:
This page contains both secure and non secure items.
Do you want to display non-secure items?
Regardless I answer no (or yes), everything works fine.
We don't like our users see that message because it makes them nervous
without any good reason.
How can I track why the browswer shows that flase security alert?
Thanks,
AlanHi Alan,
Are you using SmartNavigation in the page or referencing scripts that are
outside the Application?
Here's an article on the SmartNav problem:
Error Message When You Submit .aspx Page with SmartNav Under SSL
http://support.microsoft.com/defaul...kb;en-us;318320
"A.M" <nospam1@.online.nospam> wrote in message
news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> Hi,
> My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> shows this security alert:
> This page contains both secure and non secure items.
> Do you want to display non-secure items?
> Regardless I answer no (or yes), everything works fine.
> We don't like our users see that message because it makes them nervous
> without any good reason.
> How can I track why the browswer shows that flase security alert?
>
> Thanks,
> Alan
>
Are you using frames?
http://support.microsoft.com/defaul...b;EN-US;Q184960
"A.M" <nospam1@.online.nospam> wrote in message
news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> Hi,
> My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> shows this security alert:
> This page contains both secure and non secure items.
> Do you want to display non-secure items?
> Regardless I answer no (or yes), everything works fine.
> We don't like our users see that message because it makes them nervous
> without any good reason.
> How can I track why the browswer shows that flase security alert?
>
> Thanks,
> Alan
>
No, I don't
"Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in message
news:%23d0KaePTEHA.3552@.TK2MSFTNGP09.phx.gbl...
> Are you using frames?
> http://support.microsoft.com/defaul...b;EN-US;Q184960
> "A.M" <nospam1@.online.nospam> wrote in message
> news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
>
It is not smartnavigation because the warning pops up on one specific page.
I am pasting the page source at the end of this post:
Thanks,
Alan
========================================
=============================
<!-- Template Start-->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
<HEAD>
<title>Please Wait ...</title>
<meta name="GENERATOR" Content="Microsoft Visual Studio .NET 7.1">
<meta name="CODE_LANGUAGE" Content="C#">
<meta name="vs_defaultClientScript" content="JavaScript">
<meta name="vs_targetSchema"
content="http://schemas.microsoft.com/intellisense/ie5">
<script language="javascript">
self.focus();
function BeginPageLoad()
{
location.href = "LLViewer.aspx?rid=21";
}
</script>
</HEAD>
<body onload="BeginPageLoad()">
<form name="Form1" method="post"
action="LLWait.aspx?redirect=LLViewer.aspx%3frid%3d21" id="Form1">
<input type="hidden" name="__VIEWSTATE"
value=" dDwxNzg0NjA0NTg0Ozs+5wOOcjTIemMpowWPCjq0
XgZxlAA=" />
<P> </P>
<P> </P>
<P> </P>
<P align="center">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.ca
b#version=6,0,29,0" width="400" height="200" VIEWASTEXT>
<param name="movie" value="/LLC/Images/PleaseWait.swf">
<param name="quality" value="high">
<embed src="http://pics.10026.com/?src=/LLC/Images/PleaseWait.swf" quality="high"
pluginspage="http://www.macromedia.com/go/getflashplayer"
type="application/x-shockwave-flash" width="400" height="200"></embed>
</object>
</P>
<P> </P>
</form>
</body>
</HTML>
<!-- Template End-->
========================================
=============================
"Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in message
news:eH1BFdPTEHA.2408@.tk2msftngp13.phx.gbl...
> Hi Alan,
> Are you using SmartNavigation in the page or referencing scripts that are
> outside the Application?
> Here's an article on the SmartNav problem:
> Error Message When You Submit .aspx Page with SmartNav Under SSL
> http://support.microsoft.com/defaul...kb;en-us;318320
>
> "A.M" <nospam1@.online.nospam> wrote in message
> news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
>
Hi,
the error occurs because browser is fetching content both from secure and
insecure pages. Unless there isn't any clear that comes with HTTP (and uses
SSL that is HTTPS), you just need to remove the HTML snippet by snippet to
test out which part causes the problem.
Teemu Keiski
MCP, Microsoft MVP (ASP.NET), AspInsiders member
ASP.NET Forum Moderator, AspAlliance Columnist
http://blogs.aspadvice.com/joteke
"A.M" <nospam1@.online.nospam> wrote in message
news:edCLHPWTEHA.2128@.TK2MSFTNGP11.phx.gbl...
> No, I don't
> "Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in messa
ge
> news:%23d0KaePTEHA.3552@.TK2MSFTNGP09.phx.gbl...
6
>

This page contains both secure and non secure items.

Hi,

My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
shows this security alert:

This page contains both secure and non secure items.
Do you want to display non-secure items?

Regardless I answer no (or yes), everything works fine.

We don't like our users see that message because it makes them nervous
without any good reason.

How can I track why the browswer shows that flase security alert?

Thanks,
AlanHi Alan,

Are you using SmartNavigation in the page or referencing scripts that are
outside the Application?

Here's an article on the SmartNav problem:

Error Message When You Submit .aspx Page with SmartNav Under SSL

http://support.microsoft.com/defaul...kb;en-us;318320

"A.M" <nospam1@.online.nospam> wrote in message
news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> Hi,
> My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> shows this security alert:
> This page contains both secure and non secure items.
> Do you want to display non-secure items?
> Regardless I answer no (or yes), everything works fine.
> We don't like our users see that message because it makes them nervous
> without any good reason.
> How can I track why the browswer shows that flase security alert?
>
> Thanks,
> Alan
Are you using frames?

http://support.microsoft.com/defaul...b;EN-US;Q184960

"A.M" <nospam1@.online.nospam> wrote in message
news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> Hi,
> My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> shows this security alert:
> This page contains both secure and non secure items.
> Do you want to display non-secure items?
> Regardless I answer no (or yes), everything works fine.
> We don't like our users see that message because it makes them nervous
> without any good reason.
> How can I track why the browswer shows that flase security alert?
>
> Thanks,
> Alan
No, I don't
"Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in message
news:%23d0KaePTEHA.3552@.TK2MSFTNGP09.phx.gbl...
> Are you using frames?
> http://support.microsoft.com/defaul...b;EN-US;Q184960
> "A.M" <nospam1@.online.nospam> wrote in message
> news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> > Hi,
> > My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> > shows this security alert:
> > This page contains both secure and non secure items.
> > Do you want to display non-secure items?
> > Regardless I answer no (or yes), everything works fine.
> > We don't like our users see that message because it makes them nervous
> > without any good reason.
> > How can I track why the browswer shows that flase security alert?
> > Thanks,
> > Alan
It is not smartnavigation because the warning pops up on one specific page.
I am pasting the page source at the end of this post:

Thanks,
Alan

================================================== ===================

<!-- Template Start-->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
<HEAD>
<title>Please Wait ...</title>
<meta name="GENERATOR" Content="Microsoft Visual Studio .NET 7.1">
<meta name="CODE_LANGUAGE" Content="C#">
<meta name="vs_defaultClientScript" content="JavaScript">
<meta name="vs_targetSchema"
content="http://schemas.microsoft.com/intellisense/ie5">
<script language="javascript">
self.focus();

function BeginPageLoad()
{
location.href = "LLViewer.aspx?rid=21";
}
</script>
</HEAD>
<body onload="BeginPageLoad()">
<form name="Form1" method="post"
action="LLWait.aspx?redirect=LLViewer.aspx%3frid%3d21" id="Form1">
<input type="hidden" name="__VIEWSTATE"
value="dDwxNzg0NjA0NTg0Ozs+5wOOcjTIemMpowWPCjq0XgZxlAA=" /
<P> </P>
<P> </P>
<P> </P>
<P align="center">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.ca
b#version=6,0,29,0" width="400" height="200" VIEWASTEXT>
<param name="movie" value="/LLC/Images/PleaseWait.swf">
<param name="quality" value="high">
<embed src="http://pics.10026.com/?src=/LLC/Images/PleaseWait.swf" quality="high"
pluginspage="http://www.macromedia.com/go/getflashplayer"
type="application/x-shockwave-flash" width="400" height="200"></embed>
</object>
</P>
<P> </P>
</form>
</body>
</HTML>
<!-- Template End--
================================================== ===================

"Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in message
news:eH1BFdPTEHA.2408@.tk2msftngp13.phx.gbl...
> Hi Alan,
> Are you using SmartNavigation in the page or referencing scripts that are
> outside the Application?
> Here's an article on the SmartNav problem:
> Error Message When You Submit .aspx Page with SmartNav Under SSL
> http://support.microsoft.com/defaul...kb;en-us;318320
>
> "A.M" <nospam1@.online.nospam> wrote in message
> news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> > Hi,
> > My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE 6
> > shows this security alert:
> > This page contains both secure and non secure items.
> > Do you want to display non-secure items?
> > Regardless I answer no (or yes), everything works fine.
> > We don't like our users see that message because it makes them nervous
> > without any good reason.
> > How can I track why the browswer shows that flase security alert?
> > Thanks,
> > Alan
Hi,

the error occurs because browser is fetching content both from secure and
insecure pages. Unless there isn't any clear that comes with HTTP (and uses
SSL that is HTTPS), you just need to remove the HTML snippet by snippet to
test out which part causes the problem.

--
Teemu Keiski
MCP, Microsoft MVP (ASP.NET), AspInsiders member
ASP.NET Forum Moderator, AspAlliance Columnist
http://blogs.aspadvice.com/joteke

"A.M" <nospam1@.online.nospam> wrote in message
news:edCLHPWTEHA.2128@.TK2MSFTNGP11.phx.gbl...
> No, I don't
> "Ken Cox [Microsoft MVP]" <BANSPAMken_cox@.sympatico.ca> wrote in message
> news:%23d0KaePTEHA.3552@.TK2MSFTNGP09.phx.gbl...
> > Are you using frames?
> > http://support.microsoft.com/defaul...b;EN-US;Q184960
> > "A.M" <nospam1@.online.nospam> wrote in message
> > news:upfpDoNTEHA.3608@.TK2MSFTNGP11.phx.gbl...
> > > Hi,
> > > > My ASP.NET application uses SSL on IIS6. up on visiting some pages, IE
6
> > > shows this security alert:
> > > > This page contains both secure and non secure items.
> > > Do you want to display non-secure items?
> > > > Regardless I answer no (or yes), everything works fine.
> > > > We don't like our users see that message because it makes them nervous
> > > without any good reason.
> > > > How can I track why the browswer shows that flase security alert?
> > > > > Thanks,
> > > Alan
> >

Thursday, March 22, 2012

Thoughts about using Session variables for login security?

I am creating a simple website with a login page and some "admin only"
pages.
In my login page's submit button I just say if the "password is correct"
then...
session("IsAdmin") = True
In my admin only pages I check if session("IsAdmin") = True
If it's NOT then I redirect them to the login.aspx page.
Is this solution pretty solid, or is it easy to hack? I keep the password
in the web.config appsettings section so it's easy to change.
I know I could use Membership stuff, but I'm just doing a simple, quick
website.
Your thoughts are appreciated!Hello Bobby,

> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is
> correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True If it's
> NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the
> password in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple,
> quick website.
Membership is there, membership is quick and membership works out of the
box from the web.config if you need it to.
My experience is that this quick and simple website will run for the coming
20 years and that every time you need to change somthing you hoped you did
it the right way first time round...
--
Jesse Houwing
jesse.houwing at sogeti.nl
I've done the same thing in the past. There is one and only quesion
you need to ask: "is this doing what I need it to?" From your post the
answer is "yes," so you're good. But I see you're asking "is it easy
to hack?"
And the answer is a resounding "no." Session variables are stored in
the server's memory. In order to access them a hacker would need to
hack the server itself and gain access to it's memory. If that
happens, having them view your session variables would be the very
least of your concerns.
On Mar 5, 2:33=A0pm, "Bobby Edward" <t...@.test.com> wrote:
> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") =3D True
> In my admin only pages I check if session("IsAdmin") =3D True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? =A0I keep the passwo=[/color
]
rd
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
I'd look at Jesse's recommendation about using the built-in membership
system in ASP.Net 2.0 if you really want to have some flexibility. You can
then use Roles to manage your users. For administrators, you can create an
Admin role and assign the users to that role. Then all you have to do is
test if the user is in that role. Actually, better yet, you can set the
authorization section of the web.config file so that only certain users or
roles have access to particular files or folders. This let's you tweak
security in a config file without worrying about coding it in every single
page.
Hope this helps,
Mark Fitzpatrick
Microsoft MVP - Expression
"Bobby Edward" <test@.test.com> wrote in message
news:%23dULGfvfIHA.1188@.TK2MSFTNGP04.phx.gbl...
>I am creating a simple website with a login page and some "admin only"
>pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the password
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
>