I am working on asp.net application.
I have to work on a functionality where system admin should be able to send invitations to view user specific documents by email. When user clicks on the invitation, system should be able to recognize the user and open the document.
I am thinking of using 16 digit hash keys against each email and store them in db when admin send the invitation. When user clicks the invitation retrieving the user details using 16 digit hash key.
But I feel there could be a better way of doing it.
Please suggest me to implement the functionality in a better way.
If your users generally have to log in, you may also want to force them to log in after clicking the link in the email before opening the document (or answer some other question), especially if the documents are at all sensitive in nature. At the very least you should disable the key after they open the document or after some amount of time has passed.
Email accounts get hacked all the time and you don't want the attacker to be able to click on the same link and gain access to any sensitive data.
In Database create a table that contains
UserDocuments { UserKey, DocumentKey, GUID, IsRead (false by default)}
store user and document key relation in this table.
Generate a random public key (GUID) and store this key in this table and send the same key to user using email, mail , phone or any direct secure way.
Let the document page contain DocumentKey in querystring.
When user opens the document page, authenticate user against the DocumentKey, UserKey in the table.
Don't allow if IsRead is false.
If authentication suceeds ask them to enter GUID.
again check in database if the userid is valid, if yes open the document and mark IsRead true.
Related
Basically, I have an email service with a "forget password" functionality. There is a link being sent to the specified user that wants to reset their password.
What I want is to make that link expires after the user clicks on it (has been used).
I am using C#'s MVC, and webforms. I can't share the code for privacy purposes, unfortunately.
Any ideas?
I recommend using a stateful token.
What this means is you'll create a random guid (could be based on username, but still random).
Store that guid in a user/password linked table with the created date time and expiry time.
send the link with guid (http://emailsite.com/?token={random guid})
when the link is clicked, on page load, check the random guid param against the database.
if it doesn't exist, no password reset allowed. if it does exist and the current time is not > than expiry, allow password reset and delete the record. If it's to old, just tell them it's expired and delete the row.
instead of deleting the record, you can set it to inactive using a tinyint column.
I am designing some Forgot Password functionality in an ASP.NET application, and had a question about the best way to secure the endpoint where a user can reset their password.
How I imagine this to work is (roughly) the following:
User clicks 'Forgot Password' on the login form
User is taken to a screen where they will enter their email associated with their account
User is then taken to a screen where they can answer some security questions (required by my company)
After answering questions correctly, the user will be sent an email containing a link.
User clicks the link in their email which will take them to a password reset form
My question here is, how can I ensure that when someone arrives at this password reset form that they arrived there from clicking on that email link, and didn't just manually type in the URL to get there?
One solution I've thought of was to encrypt some data and append it as a parameter in the URL inside the email. So when they click that link, I can decrypt the data and ensure it came from a valid email before serving the form. But I'm not sure the best way to go about this.
A solution consists of creating a token that can be used once on the reset page. You send by email a link similar to https://example.com/PasswordLost?token=467dc4ad9acf4, then the site checks that the token is valid and displays the password change page. To add more security it is possible to limit the validity of the token in time: about ten minutes are largely sufficient. Once in use, the token should no longer be usable.
There are many ways to generate the token. You can generate a random string and store it in a database with the associated email address and the expiration date of the token. Then, you can validate it by querying the database. The other solution that I prefer, is to generate a token that is ciphered by the server. Then, you can decipher it and validate the data it contains (user email and expiration date, last password changed date). This way you don't have to store anything on the server. This is what ASP.NET Core Identity does.
You can read my blog post about how to implement Password reset feature in a web application? for more information.
Could someone explain to me how to send a verification email, without using asp.net usercreation wizard, i want it so that when the email is sent, it will contain a url link to activate an account
First Add a field to Users table called RegisterGuidId with type uniqueidentifier
Second after registration send a normal email to user with link to your activation page with new generated RegisterGuidId
Third after user redirected to you activation page use the generated guid to get user data from database
Basically what you need to do is, when the user registers generate a hash that is specific to the user (ideally something that can't be predicted by the bad guys) -> send this hash to the email that the user provided.
If you get a request with the url/hash that means he verified his account.
That's the basic idea anyway.
I'm looking for the most efficient way to remove users with duplicate emails in my asp.net MVC2 website that is using the default membership provider.
We launched this site and did not set unique emails to true, now that I am trying to implement a Forgot Username/Password feature I've come to realize over 100 users have re-registered as they forgot their password and there was no forgot password feature. This is a problem as I need to have the user enter their email to send them their username and password reset email. This fails since multiple users share an email.
I wish I had noticed the unique email option in the web.config before launch, would have saved a huge hassle. :(
I would like to delete all these accounts easily without having to do it manually 1 by 1, and I will then contact them and let them know their duplicate account has been created.
Whats the best way to go about doing this? Some users have registered with the same email up to 5 times.
You could call Membership.GetAllUsers() to get a list of all users.
Then group by MembershipUser.Email, decide which one to keep (for example, keep the account with the most recent LastActivityDate), and delete the others (Membership.DeleteUser).
It would be trivial to write a small program to do all this. Of course you might want to consider whether you should consult your users before deleting their account. E.g. you could send an email telling them that the account will be automatically deleted if they don't reply within some period.
When the user check "remember me" i want to save the username and password.
The user should be able to login directly the next time.
What is the best way to do this?
I tried isolated storage but maybe the code i wrote is incorrect.
I hope someone can help me.
There is a great how-to on how to Encrypt Data in a Windows Phone Application - it may be worth comparing that code with yours
The best and secure way to do this.. Is storing unique ID which are relevant only to the servers that you are talking to as cookies.
Algo:
Get the username and password from the user
Check for authenticity of the user.
If authenticated, then generate an unique ID relevant to this user and store it on server.
Pass on this unique ID to client side and store this in a cookie. Set the max-age
Next time when the user come to your site. Check for the unique ID on the server and also check its age as well as when it was issued
If all's well , then give access to user