Janus Web Server security - Revision history

ELowell: /* Authorization and WWW-Authenticate headers */

2016-08-30T22:30:10Z

Authorization and WWW-Authenticate headers

← Older revision		Revision as of 22:30, 30 August 2016
Line 975:		Line 975:
	</p>		</p>
	<p>		<p>
	Janus Web does <var class="term">not</var> uppercase the value for the “Authorization” header.		Janus Web does <var class="term">not</var> uppercase the value for the “Authorization” header.</p>
	~~But~~ note~~, however, that outside~~ of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string. </p></li>		<p class="note"><b>Note:</b> Outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string. </p></li>

	<li>You can set the the <code>WWW-Authenticate</code> response header with a statement like this:		<li>You can set the the <code>WWW-Authenticate</code> response header with a statement like this:

JAL: /* Form-based user authentication */ remove Sirius Mods

2016-08-08T19:10:46Z

Form-based user authentication: remove Sirius Mods

← Older revision		Revision as of 19:10, 8 August 2016
Line 554:		Line 554:

	==Form-based user authentication==		==Form-based user authentication==
	<var class="product">~~Sirius Mods~~</var> provides several facilities for		<var class="product">Janus</var> provides several facilities for
	presenting form-based user authentication.		presenting form-based user authentication.
	Still, however, the		Still, however, the HTTP protocol has limitations that force some tradeoffs in design
	HTTP protocol has limitations that force some tradeoffs in design
	and complexities in the code to support that design.		and complexities in the code to support that design.

Line 568:		Line 567:
	Clearly, this would be unacceptable.		Clearly, this would be unacceptable.
	So after a user has successfully logged in, the fact that the		So after a user has successfully logged in, the fact that the
	user has logged in to a particular userid must somehow be maintained between		user has logged in to a particular userid must somehow be maintained between pages.
	pages.

	<var class="product">Janus Web Server</var> provides basically three options for maintaining a login session:		<var class="product">Janus Web Server</var> provides basically three options for maintaining a login session:

JAL: /* Authorization and WWW-Authenticate headers */ value not uppercased

2016-08-08T18:45:13Z

Authorization and WWW-Authenticate headers: value not uppercased

← Older revision		Revision as of 18:45, 8 August 2016
Line 977:		Line 977:
	</p>		</p>
	<p>		<p>
	~~Note~~, however, that outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string. </p></li>		Janus Web does <var class="term">not</var> uppercase the value for the “Authorization” header.
			But note, however, that outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string. </p></li>

	<li>You can set the the <code>WWW-Authenticate</code> response header with a statement like this:		<li>You can set the the <code>WWW-Authenticate</code> response header with a statement like this:

JAL: /* WWW-Authenticate and Authorization headers */ change heading

2016-08-08T18:16:19Z

WWW-Authenticate and Authorization headers: change heading

← Older revision		Revision as of 18:16, 8 August 2016
Line 968:		Line 968:
	Still, it is probably a good choice in many environments.		Still, it is probably a good choice in many environments.

	===WWW-Authenticate ~~and Authorization~~ headers===		===Authorization and WWW-Authenticate headers===
	Under Model 204 7.7 and later, you can access the complete <code>Authorization</code> request header, and you can set the <code>WWW-Authenticate</code> response header.		Under Model 204 7.7 and later, you can access the complete <code>Authorization</code> request header, and you can set the <code>WWW-Authenticate</code> response header.

JAL: /* WWW-Authenticate and Authorization headers */ minor formatting

2016-08-08T18:13:26Z

WWW-Authenticate and Authorization headers: minor formatting

← Older revision		Revision as of 18:13, 8 August 2016
Line 971:		Line 971:
	Under Model 204 7.7 and later, you can access the complete <code>Authorization</code> request header, and you can set the <code>WWW-Authenticate</code> response header.		Under Model 204 7.7 and later, you can access the complete <code>Authorization</code> request header, and you can set the <code>WWW-Authenticate</code> response header.

	To access <code>Authorization</code>, use the standard <var>$Web_Hdr_Parm</var> functions. For example, to copy this header into a <var>Longstring</var>:		<ul>
			<li>To access <code>Authorization</code>, use the standard <var>$Web_Hdr_Parm</var> functions. For example, to copy this header into a <var>Longstring</var>:
	<p class="code">%auth is longstring		<p class="code">%auth is longstring
	%ls = [[$Web_Hdr_Parm_Lstr\|$web_hdr_parm_lstr]]("Authorization")		%ls = [[$Web_Hdr_Parm_Lstr\|$web_hdr_parm_lstr]]("Authorization")
	</p>		</p>
	Note, however, that outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string.		<p>
			Note, however, that outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string. </p></li>

	~~Also, you~~ can set the the <code>WWW-Authenticate</code> response header with a statement like this:		<li>You can set the the <code>WWW-Authenticate</code> response header with a statement like this:
	<p class="code">%rc = $web_response("WWW-Authenticate", -		<p class="code">%rc = $web_response("WWW-Authenticate", -
	'Digest realm="Rocketlandia", qop="auth,auth-int", ' -		'Digest realm="Rocketlandia", qop="auth,auth-int", ' -
Line 984:		Line 986:
	)		)
	</p>		</p>
	Although you could do this prior to Model 204 7.7, the <code>WWW-Authenticate</code> response header would only have an effect if a <code>401 Unauthorized</code> response was sent, and in that case, Janus Web would always put its own <code>WWW-Authenticate</code> header in front of the one set by <var>$Web_Response</var> and browsers would use that one instead. Under Model 204 7.7, if the <code>WWW-Authenticate</code> response header is set, Janus Web does not add its own.		<p>
			Although you could do this prior to Model 204 7.7, the <code>WWW-Authenticate</code> response header would only have an effect if a <code>401 Unauthorized</code> response was sent, and in that case, Janus Web would always put its own <code>WWW-Authenticate</code> header in front of the one set by <var>$Web_Response</var> and browsers would use that one instead. Under Model 204 7.7, if the <code>WWW-Authenticate</code> response header is set, Janus Web does not add its own. </p></li>
	How one uses these headers is an extremely advanced topic, and it requires deep understanding of the HTTP authentication protocols. Such information is beyond the scope of this reference, though you can find plenty of information about it on the Internet.		</ul>
			<p>
			How one uses these headers is an extremely advanced topic, and it requires deep understanding of the HTTP authentication protocols. Such information is beyond the scope of this reference, though you can find plenty of information about it on the Internet. </p>

	==User access control==		==User access control==

JAL: add links

2016-08-05T22:08:32Z

add links

← Older revision		Revision as of 22:08, 5 August 2016
Line 967:		Line 967:
	limitations and oddities.		limitations and oddities.
	Still, it is probably a good choice in many environments.		Still, it is probably a good choice in many environments.
	~~===WWW-Authenticate and Authorization Headers===~~
	~~Under Model 204 7.7 and later, the complete <var>Authorization</var> request header can be accessed and the <var>WWW-Authenticate</var> response header set.~~

	<~~var~~>Authorization</~~var~~> can ~~be accessed via~~ the standard <var>$~~web_hdr_parm~~</var> functions. For example, to copy this header into a ~~longstring one can do~~:		===WWW-Authenticate and Authorization headers===
			Under Model 204 7.7 and later, you can access the complete <code>Authorization</code> request header, and you can set the <code>WWW-Authenticate</code> response header.

			To access <code>Authorization</code>, use the standard <var>$Web_Hdr_Parm</var> functions. For example, to copy this header into a <var>Longstring</var>:
	<p class="code">%auth is longstring		<p class="code">%auth is longstring
	%ls = $web_hdr_parm_lstr("Authorization")		%ls = [[$Web_Hdr_Parm_Lstr\|$web_hdr_parm_lstr]]("Authorization")
	</p>		</p>
	Note however that outside of <var>NEWSESCMD</var> processing, <code>$~~web_hdr_parm_lstr~~("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string.		Note, however, that outside of <var>[[NEWSESCMD (JANUS DEFINE parameter)\|NEWSESCMD]]</var> processing, <code>$Web_hdr_parm_lstr("Authorization")</code> and other <var>$web_hdr_parm</var> functions will always indicate that this header is a null string.

	Also, ~~one~~ can set the the <~~var~~>WWW-Authenticate</~~var~~> response header with ~~something~~ like:		Also, you can set the the <code>WWW-Authenticate</code> response header with a statement like this:
	<p class="code">%rc = $web_response("WWW-Authenticate", -		<p class="code">%rc = $web_response("WWW-Authenticate", -
	'Digest realm="Rocketlandia", qop="auth,auth-int", ' -		'Digest realm="Rocketlandia", qop="auth,auth-int", ' -
Line 983:		Line 984:
	)		)
	</p>		</p>
	~~One~~ could do this ~~even before~~ Model 204 7.7 ~~but~~ the <~~var~~>WWW-Authenticate</~~var~~> response header would only have an effect if a <~~var~~>401 Unauthorized</~~var~~> response is sent and, in that case, Janus Web would always put its own <~~var~~>WWW-Authenticate</~~var~~> header in front of the one set by <var>$~~web_response~~</var> and browsers would use that one instead. Under Model 204 7.7, if the <~~var~~>WWW-Authenticate</~~var~~> response header is set, Janus Web does not add its own.		Although you could do this prior to Model 204 7.7, the <code>WWW-Authenticate</code> response header would only have an effect if a <code>401 Unauthorized</code> response was sent, and in that case, Janus Web would always put its own <code>WWW-Authenticate</code> header in front of the one set by <var>$Web_Response</var> and browsers would use that one instead. Under Model 204 7.7, if the <code>WWW-Authenticate</code> response header is set, Janus Web does not add its own.

	How one uses these headers is an extremely advanced topic and requires deep understanding of the HTTP authentication protocols. ~~This~~ information is beyond the scope of this reference though ~~one~~ can find plenty of information about it on the ~~web~~.		How one uses these headers is an extremely advanced topic, and it requires deep understanding of the HTTP authentication protocols. Such information is beyond the scope of this reference, though you can find plenty of information about it on the Internet.

	==User access control==		==User access control==

Alex: /* WWW-Authenticate and Authorization Headers */

2016-08-05T06:41:40Z

WWW-Authenticate and Authorization Headers

← Older revision		Revision as of 06:41, 5 August 2016
Line 979:		Line 979:
	<p class="code">%rc = $web_response("WWW-Authenticate", -		<p class="code">%rc = $web_response("WWW-Authenticate", -
	'Digest realm="Rocketlandia", qop="auth,auth-int", ' -		'Digest realm="Rocketlandia", qop="auth,auth-int", ' -
	'nonce="~~dcd98b7102dd2f0e8b11d0f600bfb0c093~~", ' -		'nonce="' %nonce:stringToHex '", ' -
	'opaque="~~5ccc069c403ebaf9f0171e9517f40e41~~"' -		'opaque="' %opaqueStringToHex '"' -
	)		)
	</p>		</p>
			One could do this even before Model 204 7.7 but the <var>WWW-Authenticate</var> response header would only have an effect if a <var>401 Unauthorized</var> response is sent and, in that case, Janus Web would always put its own <var>WWW-Authenticate</var> header in front of the one set by <var>$web_response</var> and browsers would use that one instead. Under Model 204 7.7, if the <var>WWW-Authenticate</var> response header is set, Janus Web does not add its own.

			How one uses these headers is an extremely advanced topic and requires deep understanding of the HTTP authentication protocols. This information is beyond the scope of this reference though one can find plenty of information about it on the web.

	==User access control==		==User access control==

Alex: /* Processing a posted login form */

2016-08-05T06:34:23Z

Processing a posted login form

@@ Line 967: / Line 967: @@
 limitations and oddities.
 Still, it is probably a good choice in many environments.
 ==User access control==

Dme at 20:26, 14 October 2011

2011-10-14T20:26:55Z

JAL2 at 21:34, 13 October 2011

2011-10-13T21:34:20Z

← Older revision		Revision as of 21:34, 13 October 2011
Line 856:		Line 856:
	<var>$Sir_Login</var> returns a 0 if the login succeeded and a 1 if it failed.		<var>$Sir_Login</var> returns a 0 if the login succeeded and a 1 if it failed.
	<var>$Sir_Login</var> also has optional parameters to allow password changes		<var>$Sir_Login</var> also has optional parameters to allow password changes
	and to have login messages captured to a [[$list]] or <var>Stringlist</var> object.		and to have login messages captured to a [[$lists\|$list]] or to a <var>Stringlist</var> object.

	Capturing messages to a $list, for example, can be especially useful to provide		Capturing messages to a $list, for example, can be especially useful to provide

← Older revision		Revision as of 20:26, 14 October 2011
Line 389:		Line 389:
	This URL would have to have code behind it to be clever enough to not send a <code>401		This URL would have to have code behind it to be clever enough to not send a <code>401
	"Unauthorized"</code> after a successful password changed.		"Unauthorized"</code> after a successful password changed.
	One way this could be accomplished is with a <var>[[JANUS WEB ~~Exception~~ rules#newpwrd\|NEWPASSWORD]]</var> exception handler.		One way this could be accomplished is with a <var>[[JANUS WEB exception rules#newpwrd\|NEWPASSWORD]]</var> exception handler.

	A third password change mechanism is also available to <var class="product">Janus Web Server</var> sites, namely		A third password change mechanism is also available to <var class="product">Janus Web Server</var> sites, namely
Line 520:		Line 520:
	logon failure, resulting in yet another logon pop-up window.		logon failure, resulting in yet another logon pop-up window.

	To deal with this problem, a <var>[[JANUS WEB ~~Exception~~ rules#logonerr\|LOGONERR]]</var> exception handler should be written		To deal with this problem, a <var>[[JANUS WEB exception rules#logonerr\|LOGONERR]]</var> exception handler should be written
	to try to determine the cause of a logon failure (probably with the <var>$Web_Num_Logmsg</var>		to try to determine the cause of a logon failure (probably with the <var>$Web_Num_Logmsg</var>
	and <var>$Web_Logmsg</var> functions).		and <var>$Web_Logmsg</var> functions).
Line 995:		Line 995:

	<var class="product">Janus Web Server</var> provides the ability to write an		<var class="product">Janus Web Server</var> provides the ability to write an
	<var>[[JANUS WEB ~~Exception~~ rules#unauth\|UNAUTHORIZED]]</var> exception handler that can better handle a "user not authorized		<var>[[JANUS WEB exception rules#unauth\|UNAUTHORIZED]]</var> exception handler that can better handle a "user not authorized
	for URL" situation.		for URL" situation.
	An <var>UNAUTHORIZED</var> exception handler could simply send the following		An <var>UNAUTHORIZED</var> exception handler could simply send the following
Line 1,048:		Line 1,048:

	Instead of the wrapper approach, however, a user's inability to enter a subsystem		Instead of the wrapper approach, however, a user's inability to enter a subsystem
	can be more gracefully handled with a <var>[[JANUS WEB ~~Exception~~ rules#nodone\|NODONE]]</var> exception handler.		can be more gracefully handled with a <var>[[JANUS WEB exception rules#nodone\|NODONE]]</var> exception handler.
	For example, the following two web rules		For example, the following two web rules
	indicate that any request for a URL that begins with		indicate that any request for a URL that begins with