Can I tell if a user came thru a secure site?

microsoft.public.dotnet.security

30 Mar 2006 3:25 AM

Sega

My web app is not on a secure server. However, before getting to my app, a
user is supposed to logon thru a secure server. Is there any way to tell
that the user has been approved and is coming from the secure site rather
than just typing the url in their browser?

Is there any way to pass info from the secure server to my server? Something
that I could check & verify, but a user would not be able to see?

Also, can just a directory on a server be made secure?

Thanks for any help

30 Mar 2006 9:13 AM

Dominick Baier [DevelopMentor]

whats secure??

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> My web app is not on a secure server. However, before getting to my
> app, a user is supposed to logon thru a secure server. Is there any
> way to tell that the user has been approved and is coming from the
> secure site rather than just typing the url in their browser?
>
> Is there any way to pass info from the secure server to my server?
> Something that I could check & verify, but a user would not be able
> to see?
>
> Also, can just a directory on a server be made secure?
>
> Thanks for any help
>

31 Mar 2006 12:04 PM

oldbear

Hi

If you mean 'has the user come from a site using SSL', then you can look at
a server variable (HTTP_REFERER) to see which site they have come from.

http://www.lib.washington.edu/asp/browser/servar.asp

I'm not sure if this could be relied on for security purposes.

Hope this helps

Chris Seary

http://blog.searyblog.com/

31 Mar 2006 1:50 PM

Nicole Calinoiu

"oldbear" <oldb***@discussions.microsoft.com> wrote in message
news:6AD14437-B5CF-480B-9E8F-25A428EF3441@microsoft.com...
> Hi
>
> If you mean 'has the user come from a site using SSL', then you can look
> at
> a server variable (HTTP_REFERER) to see which site they have come from.
>
> http://www.lib.washington.edu/asp/browser/servar.asp
>
> I'm not sure if this could be relied on for security purposes.

Absolutely not. The referrer header is client-provided data and, as such,
is trivial to spoof. In addition, some users may wish to prevent their
browsers from sending referrer data due to privacy concerns, so one can't
generally count on the header being accurately populated even by
non-malicious clients.

31 Mar 2006 3:08 PM

Sega

I am new to this so may not be using terminology correctly. Basically a user
is supposte to get in via a "secure" site where he logs in & is verified. If
OK he is then sent to my program which is not on a secure site. He gets the
"leaving secure site" message. However, if users know the url to my program
they can get in directly without being verified.

I want to know if there is any way I can tell if the user got to my program
via the secure site where his userid & logon were verified. Can the logon
prgram pass some hidden flag? Are there any system type variables, to tell
me where he is coming from, for example the log in site or directly via a
url? I've looked at request.systemvariables, but they seem to do with with

The program is written withn vb.net & asp.net
Thanks for any help you can give.

Show quoteHide quote

"Dominick Baier [DevelopMentor]" wrote:

> whats secure??
>
> ---------------------------------------
> Dominick Baier - DevelopMentor
> http://www.leastprivilege.com
>
> > My web app is not on a secure server. However, before getting to my
> > app, a user is supposed to logon thru a secure server. Is there any
> > way to tell that the user has been approved and is coming from the
> > secure site rather than just typing the url in their browser?
> >
> > Is there any way to pass info from the secure server to my server?
> > Something that I could check & verify, but a user would not be able
> > to see?
> >
> > Also, can just a directory on a server be made secure?
> >
> > Thanks for any help
> >
>
>
>

31 Mar 2006 3:29 PM

Dominick Baier [DevelopMentor]

so - the login app and your app are on different machines?

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> I am new to this so may not be using terminology correctly. Basically
> a user is supposte to get in via a "secure" site where he logs in & is
> verified. If OK he is then sent to my program which is not on a
> secure site. He gets the "leaving secure site" message. However, if
> users know the url to my program they can get in directly without
> being verified.
>
> I want to know if there is any way I can tell if the user got to my
> program via the secure site where his userid & logon were verified.
> Can the logon prgram pass some hidden flag? Are there any system type
> variables, to tell me where he is coming from, for example the log in
> site or directly via a url? I've looked at request.systemvariables,
> but they seem to do with with
>
> The program is written withn vb.net & asp.net
> Thanks for any help you can give.
> "Dominick Baier [DevelopMentor]" wrote:
>
>> whats secure??
>>
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>> My web app is not on a secure server. However, before getting to my
>>> app, a user is supposed to logon thru a secure server. Is there
>>> any way to tell that the user has been approved and is coming from
>>> the secure site rather than just typing the url in their browser?
>>>
>>> Is there any way to pass info from the secure server to my server?
>>> Something that I could check & verify, but a user would not be able
>>> to see?
>>>
>>> Also, can just a directory on a server be made secure?
>>>
>>> Thanks for any help
>>>

1 Apr 2006 7:22 PM

Sega

Not sure how all this fits in or even if I am using secure or site properly.
None of this is for the public. It is for an organization that only wants
their members to have access, although remotely over the Internet.

The site, where the user logs in , is an https site, for example
(https://mt1234.xconnection.com/signin/xxx.htm). This sends a logon screen,
& it verifyies id & password. If OK it transfers to a menu. If my web
programs option is selected from the men, it then transfers to my directory
and program via , for example,
http://mt4568.xconnection.com/mydirectory/.default.aspx?variousparameters.

I have been told that my site used to be on a different machine and
different domain name, but is now on the same machine, but a different site.

Only after changing it to this new setup did the problems start. Before if
my programs http address was put directly into a url, it would get sent to
the login site. Good. We want this. Everyone happy. Now since it has been
changed, typing in my program's http url directly, gets directly in, no login
required. Not good.

Not getting much help from the server/set up people. They think I should
control this in my program. Happy to do so but how?

The program, which I inherited has Windows Authentication in the Web.config.
Can I use Forms authentication across "sites" like this has? Can I tell if
is coming from outside and not going thru the normal route of password
verification?
Should I be able to do this in my program? Can or should the server itself
be set up with some permissions or denials?

I have been reading, reading, about security, authentication, authorization,
BUT NOT GETTING TO AN UNDERSTANDING. This is my first time with this & WOW.

Thanks for any help anyone can give.

Show quoteHide quote

"Dominick Baier [DevelopMentor]" wrote:

> so - the login app and your app are on different machines?
>
> ---------------------------------------
> Dominick Baier - DevelopMentor
> http://www.leastprivilege.com
>
> > I am new to this so may not be using terminology correctly. Basically
> > a user is supposte to get in via a "secure" site where he logs in & is
> > verified. If OK he is then sent to my program which is not on a
> > secure site. He gets the "leaving secure site" message. However, if
> > users know the url to my program they can get in directly without
> > being verified.
> >
> > I want to know if there is any way I can tell if the user got to my
> > program via the secure site where his userid & logon were verified.
> > Can the logon prgram pass some hidden flag? Are there any system type
> > variables, to tell me where he is coming from, for example the log in
> > site or directly via a url? I've looked at request.systemvariables,
> > but they seem to do with with
> >
> > The program is written withn vb.net & asp.net
> > Thanks for any help you can give.
> > "Dominick Baier [DevelopMentor]" wrote:
> >
> >> whats secure??
> >>
> >> ---------------------------------------
> >> Dominick Baier - DevelopMentor
> >> http://www.leastprivilege.com
> >>> My web app is not on a secure server. However, before getting to my
> >>> app, a user is supposed to logon thru a secure server. Is there
> >>> any way to tell that the user has been approved and is coming from
> >>> the secure site rather than just typing the url in their browser?
> >>>
> >>> Is there any way to pass info from the secure server to my server?
> >>> Something that I could check & verify, but a user would not be able
> >>> to see?
> >>>
> >>> Also, can just a directory on a server be made secure?
> >>>
> >>> Thanks for any help
> >>>
>
>
>

2 Apr 2006 3:31 AM

John Parrish

There really is not enough information in this to assist you. There are
many ways credentials can be passed / handled within ASP.NET and IIS, so
without any knowledge of your previous setup, I can only assume that if
things were working fine and a move to a different server broke things,
most likely IIS was configured to handle authentication.

If that is not the case, unfortunately some implementation detail has
broken due to the move, and that will take detailed knowledge of that
implementation in order to rectify it.

If you are able to narrow the issue down some please do.

Regards

John Parrish

Sega wrote:
Show quoteHide quote

> Not sure how all this fits in or even if I am using secure or site properly.
> None of this is for the public. It is for an organization that only wants
> their members to have access, although remotely over the Internet.
>
> The site, where the user logs in , is an https site, for example
> (https://mt1234.xconnection.com/signin/xxx.htm). This sends a logon screen,
> & it verifyies id & password. If OK it transfers to a menu. If my web
> programs option is selected from the men, it then transfers to my directory
> and program via , for example,
> http://mt4568.xconnection.com/mydirectory/.default.aspx?variousparameters.
>
> I have been told that my site used to be on a different machine and
> different domain name, but is now on the same machine, but a different site.
>
> Only after changing it to this new setup did the problems start. Before if
> my programs http address was put directly into a url, it would get sent to
> the login site. Good. We want this. Everyone happy. Now since it has been
> changed, typing in my program's http url directly, gets directly in, no login
> required. Not good.
>
> Not getting much help from the server/set up people. They think I should
> control this in my program. Happy to do so but how?
>
> The program, which I inherited has Windows Authentication in the Web.config.
> Can I use Forms authentication across "sites" like this has? Can I tell if
> is coming from outside and not going thru the normal route of password
> verification?
> Should I be able to do this in my program? Can or should the server itself
> be set up with some permissions or denials?
>
> I have been reading, reading, about security, authentication, authorization,
> BUT NOT GETTING TO AN UNDERSTANDING. This is my first time with this & WOW.
>
> Thanks for any help anyone can give.
>

31 Mar 2006 4:10 PM

oldbear

Hi

I'm not sure if you're trying to plug into an authentication architecture
that already exists, or whether you're setting up both sites yourself. If
you're starting from scratch, then you could look at using the WS-Federation
specification:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnglobspec/html/passive-client-profile.asp

This is used by sites such as the UK Government Gateway.

The Signed Security Token is often Security Assertion Markup Language (SAML):
http://www.gotdotnet.com/codegallery/codegallery.aspx?id=8da852b9-2c0d-4eb7-a2de-77222a4075f6

If you're not starting from scratch, then you can disregard this.

Cheers

Chris Seary

http://blog.searyblog.com/

4 Apr 2006 9:31 AM

Sharat Koya

if you mean you want to know if the user came in via an SSL page then...

http://www.quepublishing.com/articles/article.asp?p=28493&seqNum=4

Request.ServerVariables( "SERVER_PORT_SECURE") will return 1 for secure and
0 for not secure port.

Show quoteHide quote

"Sega" wrote:

> I am new to this so may not be using terminology correctly. Basically a user
> is supposte to get in via a "secure" site where he logs in & is verified. If
> OK he is then sent to my program which is not on a secure site. He gets the
> "leaving secure site" message. However, if users know the url to my program
> they can get in directly without being verified.
>
> I want to know if there is any way I can tell if the user got to my program
> via the secure site where his userid & logon were verified. Can the logon
> prgram pass some hidden flag? Are there any system type variables, to tell
> me where he is coming from, for example the log in site or directly via a
> url? I've looked at request.systemvariables, but they seem to do with with
>
> The program is written withn vb.net & asp.net
> Thanks for any help you can give.
>
> "Dominick Baier [DevelopMentor]" wrote:
>
> > whats secure??
> >
> > ---------------------------------------
> > Dominick Baier - DevelopMentor
> > http://www.leastprivilege.com
> >
> > > My web app is not on a secure server. However, before getting to my
> > > app, a user is supposed to logon thru a secure server. Is there any
> > > way to tell that the user has been approved and is coming from the
> > > secure site rather than just typing the url in their browser?
> > >
> > > Is there any way to pass info from the secure server to my server?
> > > Something that I could check & verify, but a user would not be able
> > > to see?
> > >
> > > Also, can just a directory on a server be made secure?
> > >
> > > Thanks for any help
> > >
> >
> >
> >

4 Apr 2006 9:16 AM

Dominick Baier [DevelopMentor]

which i can easily set myself....

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> if you mean you want to know if the user came in via an SSL page
> then...
>
> http://www.quepublishing.com/articles/article.asp?p=28493&seqNum=4
>
> Request.ServerVariables( "SERVER_PORT_SECURE") will return 1 for
> secure and 0 for not secure port.
>
> "Sega" wrote:
>
>> I am new to this so may not be using terminology correctly.
>> Basically a user is supposte to get in via a "secure" site where he
>> logs in & is verified. If OK he is then sent to my program which is
>> not on a secure site. He gets the "leaving secure site" message.
>> However, if users know the url to my program they can get in directly
>> without being verified.
>>
>> I want to know if there is any way I can tell if the user got to my
>> program via the secure site where his userid & logon were verified.
>> Can the logon prgram pass some hidden flag? Are there any system
>> type variables, to tell me where he is coming from, for example the
>> log in site or directly via a url? I've looked at
>> request.systemvariables, but they seem to do with with
>>
>> The program is written withn vb.net & asp.net
>> Thanks for any help you can give.
>> "Dominick Baier [DevelopMentor]" wrote:
>>
>>> whats secure??
>>>
>>> ---------------------------------------
>>> Dominick Baier - DevelopMentor
>>> http://www.leastprivilege.com
>>>> My web app is not on a secure server. However, before getting to my
>>>> app, a user is supposed to logon thru a secure server. Is there
>>>> any way to tell that the user has been approved and is coming from
>>>> the secure site rather than just typing the url in their browser?
>>>>
>>>> Is there any way to pass info from the secure server to my server?
>>>> Something that I could check & verify, but a user would not be
>>>> able to see?
>>>>
>>>> Also, can just a directory on a server be made secure?
>>>>
>>>> Thanks for any help
>>>>