Develop Reference

Can cache-control affect Session.Timeout?

We have a .NET Framework web app where we use .ASPAUTH cookie and ASP.NET_SessionId for authenticated user. Our Session.Timeout is set to 60 minutes in the IIS hosted web.config file.
Recently I follow the recommendation of OWASP top 10 to prevent possible information exposure by Disable caching for response that contain sensitive data.
I did this by adding the following in the Web.config file of the web app.
<httpProtocol>
<customHeaders>
<add name="Cache-Control" value="no-cache, no-store" />
<add name="Pragma" value="no-cache" />
<add name="Expires" value="0" />
</customHeaders>
</httpProtocol>
The very next day I start getting call from some users (not all) that they got redirect to the log out page by simply clicking on links in our web application. So I did what naturally comes to me is to roll back that change and off course that complains went a way gradually.
This puzzle me, as I don't know how http response caching directive could lead to invalidating a user session and log them out. Even though I see the issue went away, there is no way for me to confirm that it was due to my roll back of these header values.
I know the Pragma and Expires are from Pre HTTP 1.1 so I plan to add the following back in and see if I have the log out issue again.
<add name="Cache-Control" value="private, max-age=3600, must-revalidate" />
Do you think they are related? I researched around and all I could come up is the cache control really affect how often the user request resource from server. One factor I don't have control over is can something on the user's browser end that when combine with this Cache-Control directive can destroy their authenticated session?
Update: I see this refers briefly at this resource. However, they don't really go into the details.

googleConsumerKey and googleConsumerSecret for DotNotOpenAuth library

I am completely new to DotNetOpenAuth library and am currently trying to use it in a WebForms ASP.Net website project. I have successfully installed the library in my website using Nuget.
However, when looking at the samples for this library, I found the following 2 keys in web config. I did go to the sign-up URL mentioned, but could not get these keys. I also tried looking up the docs for this library, but could not find any thing on these 2 keys.
<!-- Google sign-up: https://www.google.com/accounts/ManageDomains -->
<add key="googleConsumerKey" value="anonymous" />
<add key="googleConsumerSecret" value="anonymous" />
Question
How do I get googleConsumerKey and googleConsumerSecret for use with my website, so I can have users login using their Google account?

It can be difficult to find, there is soooo much google stuff that they offer that sometimes the thing you want is not easy to find.
Try
https://console.developers.google.com/apis/credentials
For Capcha keys use
https://www.google.com/recaptcha/admin

enable google map

Ii have a webpage which has a map control from:
(http://www.codeproject.com/Articles/24468/Google-Maps-Control-for-ASP-NET-Part-1)
When I run it from http://localhost it executes fine. When I move it to my actual website, the page goes blank. Is this only for testing on localhost or is there anything else I'm missing. Can anybody guess what the problem is?
Is there any other way to have maps running
I am using VS2k8

For v2 of the Google maps API, which the code in GoogleMapControl.zip uses, Google doesn't check the API key when running on localhost but they do when running elsewhere. Make sure that you have a valid API key from Google and add it to the Web.config:
<appSettings>
<add key="GoogleAPIKey" value=""/>
</appSettings>
There is a comment at the top of Page_Load() in SimpleMapWithNoBubble.aspx.cs that documents this.
Regarding the version of the API, in cGoogleMap.cs:
string _apiversion = "2";
I didn't dig any further to see if the code is written well enough that you could just change to v3 but it's worth a quick try.
As noted at the valid API key link above and in the comments below, v2 of the API is officially depreciated and it's scheduled to go away no later than April 20, 2015.

Is there a Hello World example for the Google Contacts API in Java, C#, Python or Ruby?

Question
Can anyone point me to a step-by-step example which explains how to get started with the Google Contacts API and shows a complete working demo?
Preferably in Java, but it can also be in C#, Python or Ruby.
Goal
All I want to do is to
load an existing contact,
add it to a group and
save the contact back.
Problems
I am pretty much failing on every level.
Can't get the authentication to work
Can't find the libraries that contain the classes which are used in the code snippets I found on the Internet
Can't perform CRUD operations on an existing contact
Example
Here is some pseudo-code of what I am looking for.
import com.google.contacts.*
public class UpdateContactDemo {
public static void main(String args[]) {
GoogleContactsApi g = new GoogleContactsApi("username", "password");
Contact c = g.get("Bob");
c.addGroup("Friends");
g.save(c);
}
}
What I already did
Ok, I googled for tutorials, API examples and everything else I could think of -- and failed. I found a bunch of sources like these:
Google Contacts API v3
API Directory
Contacts Reference Guide
But non contained an end-to-end example for beginners.

My approach for C# was this one:
http://nanovazquez.com/2013/01/18/working-with-google-calendar-on-dotnet/
The code can be found on github: here
<?xml version="1.0" encoding="utf-8"?>
<configuration>
...
<appSettings>
...
<!-- GoogleAPI credentials -->
<add key="ClientId" value="{CLIENT-ID}" />
<add key="ClientSecret" value="{CLIENT-SECRETD}" />
<!-- Update the port of the Redirect URI (don't forget to set this value also in the Google API Console) -->
<add key="RedirectUri" value="http://localhost:{PORT}/Account/GoogleAuthorization" />
</appSettings>
<system.web>
...
</configuration>
</xml>
You can remove the existing Google Calendar api and add Google Contacts Api.
Give this a try.
This has Oauth implementation and works, but the code samples from the code.google.com don't.
Is the best I found so far.

Sessions stored in a co-located Azure cache gets out of sync on multiple instances

For my MVC4 application, run in Azure, I store the sessions in a co-located cache. As described in this How-to that Microsoft provide.
I run two small instances, and everything seems to work fine. I can log in to the application, and I remain logged in when I browse around within the application. So the session seem to work on both instances.
However, when I update the session data something like this:
HttpContext.Current.Session["someVar"] = "new value";
That change only seem to have an effect on the instance that handle that particular request. Now as I browse around the application, sometimes I get the initial value and sometimes I get the updated value.
I haven't made any changes to the web.config, so it looks exactly as it do when it gets added by the Nuget package:
<sessionState mode="Custom" customProvider="AppFabricCacheSessionStoreProvider">
<providers>
<add name="AppFabricCacheSessionStoreProvider"
type="Microsoft.Web.DistributedCache.DistributedCacheSessionStateStoreProvider, Microsoft.Web.DistributedCache"
cacheName="default"
useBlobMode="true"
dataCacheClientName="default" />
</providers>
</sessionState>
Do I need to handle sessions in another way when using the Azure cache, or is it something else I'm missing here?

You need to assign an applicationName so that the distributed cache can view the shared state within the same application boundary. See MSDN forum post for reference.
<add name="AppFabricCacheSessionStoreProvider"
type="Microsoft.Web.DistributedCache.DistributedCacheSessionStateStoreProvider, Microsoft.Web.DistributedCache"
applicationName="azureMVC4App"
cacheName="default"
useBlobMode="true"
dataCacheClientName="default" />
If you want to share cache state across application boundaries, you need to assign sharedId