Inconsistent string/array formatting in JWT payload - c#

I am creating JWT's (Json Web Token) using System.IdentityModel.Token.JWT
Essentially feeding a bunch of claims into the WriteToken() method and getting a token string back.
The problem is that the formatting is inconsistent. If I add a "role" claim with a value, it's formatted as a string. If I add one more "role" claim it's formatted as an array. And the consumer has to do special processing to figure out what it is.
The docs say :
"For each Claim a JSON pair { 'Claim.Type', 'Claim.Value' } is added. If duplicate claims are found then a { 'Claim.Type', List } will be created to contain the duplicate values."
How can I avoid this and always get an array?

Related

How to read multiple cookie with same name in webapi using C#

We have two cookies created with same name.
When i am iterating through loop, i am always getting first cookie.
Is there way to access both cookie separately?
if (Request.Cookies.AllKeys.Where(x => x == "test").Count() > 1)
{
foreach (var cookie in Request.Cookies.AllKeys)
{
if (Request.Cookies[cookie].Name == "test")
{
var temp = System.Web.HttpContext.Current.Request.Cookies["test"];
temp.Expires = DateTime.Now.AddDays(-1);
Response.Cookies.Add(temp);
}
}
};
When a cookie already exists, and you update it (through the response's Cookies collection), either by adding or updating it, a second 'duplicate' cookie is added to the Request's Cookies collection. This duplicate one is actually the one you just updated.
Although I did not check this on MSDN documentation, I believe this is most probably by design. Why you ask? Because it allows you to get either YOUR current version of the cookie (the one you've just updated/added through the Response), or the one that was actually sent over by the user's browser (which is thus their current version of the cookie at this moment in time).
Now, using either Cookies.Get(name), Cookies[name] or -the way you are doing it- looping through the key collection (from the start) and then returning the first match, will always result in the first cookie beïng returned. This is the cookie as the user still knows it, thus not the one you've been updating during this request.
If you want to retrieve 'your' current version of the cookie, you must get the last one with that name, instead of the first. You can do so like this:
int index = Array.LastIndexOf(this.HttpRequest.Cookies.AllKeys, cookieKey);
if (index != -1)
{
result = this.HttpRequest.Cookies[index];
}
Of course this will also always return the correct cookie if you didn't update it within the current request.
we cannot have two cookies with the same name in a particular domain and also by default we get the cookies from the current domain. So I am not seeing a case where to you can get two cookies with the same name in the above-mentioned code.
Please mention your issue wit more detail.

DocumentDb feedResponse.ResponseContinuation JSON

When I get continuation token while querying Documents on DocumentDb NoSQL database I get feedResponse.ResponseContinuation JSON
{
"token":"+RID:r+xQAPHUJQANAAAAAAAAAA==#RT:1#TRC:10#FPC:AQ0AAAAAAAAAIAAAAAAAAAA=",
"range":{"min":"","max":"FF"}
}
Could you please explain what each field means? And how the values are set/ calculated? Is the "token" value encrypted?
Thanks.
Could you please explain what each field means? And how the values
set/ calculated ? Is "token" value encrypted?
Presence of continuation token in response headers means there's more data available for the request you made.
You should not try to interpret this value and treat it as Opaque. By opaque what I mean to say is that you should not build your business logic around this continuation token's value because in my experience, you will receive different values under different circumstances.
For example, we receive following tokens under different circumstances:
In one instance, we received the following:
{"token":"-RID:4pVnPNKLRAAGAAAAAAAAAA==#RT:1#TRC:2","range":{"min":"","max":"FF"}}.
Yet, in another instance we received the following:
{"token":null,"range":{"min":"05D1A53CB92960","max":"05D1B53CB92960"}}.
And then there's another one:
+RID:4pVnAO6fMNADAAAAAACAAQ==#RT:1#TRC:2#FPC:ALMABAAAAIABAwAAAAAAgAE=
As you can see, there's no rhyme or reason behind the value of this token.
What your code should do is check for the existence of continuation token in response headers and if it is there then include this in your next request to get next set of data.

DocumentDB - The input name is invalid. Ensure to provide a unique non-empty string less than '255' characters

I am trying to insert data into Azure DocumentDb, however I am getting the following error
The input name "123456" is invalid. Ensure to provide a unique non-empty string less than '255' characters.","The request payload is invalid. Ensure to provide a valid request payload."]}
I am using the following code:
using (MemoryStream ms = new MemoryStream(Encoding.UTF8.GetBytes(myString)))
{
await client.CreateDocumentAsync(documentCollection.DocumentsLink, Document.LoadFrom<Document>(ms));
}
This code appears to be correct, however I have also tried using the docomentCollection.SelfLink and that also fails.
The database and collection have been created and I can verify this through the azure portal, however no data is ever inserted.
DocumentDB treats id as a special property, in which it must be a unique non-empty string with less than 255 characters.
In this case, I believe you are creating a document with the id as a numeric value:
{
"id": 123456
}
You will need to cast the id to a string:
{
"id": "123456"
}

Add XML content to google contact extended property

According to google documentation for the contacts API there are two ways to assign a value to an extended property.
<gd:extendedProperty name='my-service-id' value='1234567890' />
<gd:extendedProperty name='my-second-service'>
<value-element>text value</value-element>
</gd:extendedProperty>
Using the gdata api I can assign a value easily so that I get the first format. I need to use the second format* to read and write the content between the extendedProperty tags. I found no method or property to do that. How can I do that in the gdata API?
(*) the reason I need the second format is that some contacts have only one field set (key or value) so I have to fill the other for compatibility with the google contacts api. But if the contact is formatted the second way, I cannot tell and I try to fill in a dummy attribute value, which results in a value-xml content mutually exclusive 400 bad request.
After testing I found out a solution. If the text between the gd:extendedProperty tags is plaintext it will be stored in under googlecontact->Value, but if it's XML then it will appear in googlecontact->childnodes as a List< XMLNode>.

Difference between Request.Form and Request.QueryString?

Can some tell me the exact difference between Request.Form and Request.QueryString?
I know one difference, like
If the HTTP request method is POST, the user submitted data is in the
Request.Form() collection
If the HTTP request method is GET, then user submitted data is in the
Request.QueryString() collection
any other difference? and Any example would be greatly appreciated.
In Request.Form the data is posted in the http request body whereas in QueryString data is sent through url.
I found some other difference
Request("id")
will first try to locate
Request.Form("id")
then
Request.Querystring("id")
then
Request.Cookies("id")
and finally
Request.ServerVariables("id")
it is reccommended to use the explicit naming convention if possible because it is more efficient and more readable.it also enables you to be sure where your information is coming from since the system will stop after the first hit is made.... It is also faster for the system if you specify the location of the information.
and we can refer this link for more some details :
http://www.hanselman.com/blog/ASPNETParamsCollectionVsQueryStringFormsVsRequestindexAndDoubleDecoding.aspx
But any one know any other difference, I really appreciate that .
As stated on MSDN,
(Request.Form): The value of Request.Form(element) is an array of all
the values of element that occur in the request body. You can
determine the number of values of a parameter by calling
Request.Form(element).Count. If a parameter does not have multiple
values associated with it, the count is 1. If the parameter is not
found, the count is 0.
and (Request.QueryString): The value of Request.QueryString(parameter)
is an array of all of the values of parameter that occur in
QUERY_STRING. You can determine the number of values of a parameter by
calling Request.QueryString(parameter).Count. If a variable does not
have multiple data sets associated with it, the count is 1. If the
variable is not found, the count is 0.
So, some things to note:
In a typical Form on a page, we may include some hidden elements:
<form method="post">
<input type="hidden" name="lol" value="cat" />
<input type="text" />
</form>
Hidden elements (if memory serves), are not displayed in the QueryString. So, I would assume that there are some things that are not shown in Request.QueryString. Unfortunately I am in the process of re-installing dev apps on a new machine and cannot test this at the moment but if I'm right, when you POST a form, more details about the form and its contents gets sent. And when you access QueryString, you are only seeing the things that make up the entirety of the URL, e.g.:
http://somesite.com/index.html?v=1&NonHiddenElement=lol&ManualValue=hello
Request.Form - means you are wanting to retrieve the values for the form that was posted.
Request.QueryString - means you are wanting to retrieve values that have been passed on the querystring.
Request.Form()
The Form collection retrieves the values of form elements posted to the HTTP request body, Only those elements and value which exist in your Form.
Request.QueryString()
The QueryString collection retrieves the values of the variables in the HTTP query string, Here you can append any of your custom variable and value which event dose not exist in your Form.
Request.Form Collection
The Form collection retrieves the values of form elements posted to the HTTP request body, with a form using the POST method.
Form input is contained in headers. It is wise to not trust the data that is contained in headers, as this information can be falsified by malicious users. For example, do not rely on data such as cookies to securely identify a user.
As a security precaution, always encode header data or user input before using it. A general method of encoding data is to use Server.HTMLEncode. Alternatively, you can validate header data and user input with a short function such as the one described in Validating User Input to Avoid Attacks. For more detailed information about developing secure Web applications, see chapter 12 of MS Press - Writing Secure Code.
Syntax
Request.Form(element)[(index)|.Count]
Parameters
element
The name of the form element from which the collection is to retrieve values.
index
An optional parameter that enables you to access one of multiple values for a parameter. It can be any integer in the range 1 to Request.Form(parameter).Count.
Applies To
Request Object
Remarks
The Form collection is indexed by the names of the parameters in the request body. The value of Request.Form(element) is an array of all the values of element that occur in the request body. You can determine the number of values of a parameter by calling Request.Form(element).Count. If a parameter does not have multiple values associated with it, the count is 1. If the parameter is not found, the count is 0.
To reference a single value of a form element that has multiple values, you must specify a value for the index parameter. The index parameter may be any number between 1 and Request.Form(element).Count. If you reference one of multiple form parameters without specifying a value for index, the data is returned as a comma-delimited string.
When you use parameters with Request.Form, the Web server parses the HTTP request body and returns the specified data. If your application requires unparsed data from the form, you can access it by calling Request.Form without any parameters.
Request.QueryString Collection
The QueryString collection retrieves the values of the variables in the HTTP query string. The HTTP query string is specified by the values following the question mark (?). Several different processes can generate a query string. For example, the following anchor tag generates a variable named string with the value "this is a sample."
string sample
Query strings are also generated by sending a form or by a user typing a query into the address box of the browser.
Query strings are contained in request headers. It is wise to not trust the data that is contained in headers, as this information can be falsified by malicious users. For example, do not rely on data such as cookies to securely identify a user.
As a security precaution, always encode header data or user input before using it. A general method of encoding data is to use Server.HTMLEncode. Alternatively, you can validate header data and user input with a short function such as the one described in Validating User Input to Avoid Attacks. For more detailed information about developing secure Web applications, see chapter 12 of MS Press - Writing Secure Code.
Syntax
Request.QueryString(variable)[(index)|.Count]
Parameters
variable
Specifies the name of the variable in the HTTP query string to retrieve.
index
An optional parameter that enables you to retrieve one of multiple values for variable. It can be any integer value in the range 1 to Request.QueryString(variable).Count.
Applies To
Request Object
Remarks
The QueryString collection is a parsed version of the QUERY_STRING variable in the ServerVariables collection. It enables you to retrieve the QUERY_STRING variable by name. The value of Request.QueryString(parameter) is an array of all of the values of parameter that occur in QUERY_STRING. You can determine the number of values of a parameter by calling Request.QueryString(parameter).Count. If a variable does not have multiple data sets associated with it, the count is 1. If the variable is not found, the count is 0.
To reference a QueryString variable in one of multiple data sets, you specify a value for index. The index parameter can be any value between 1 and Request.QueryString(variable).Count. If you reference one of multiple QueryString variables without specifying a value for index, the data is returned as a comma-delimited string.
When you use parameters with Request.QueryString, the server parses the parameters sent to the request and returns the specified data. If your application requires unparsed QueryString data, you can retrieve it by calling Request.QueryString without any parameters.
You can use an iterator to loop through all the data values in a query string.
For example, if the following request is sent:
for more details click this link

Categories