passwords in the source? - ASP / Active Server Pages

jp2code

I've got some files that are not very sensitive. Mostly history files from
email sessions using our contact forms.

I'd like to password protect these files so that if someone happened to get
a link to it, they couldn't start passing it all around for anyone to read,
and I certainly wouldn't want the link to find its way into a Google search!

I've thought about creating a password string that I could hold in the <%
[code] %portion of my .asp pages. Then, if someone tries to open a history
file, they are first prompted for a password. If it matches what is in the
<% [code] %section, they get in.

I just feel like my password is left out in the clear if I include it as
part of the asp code.

Is this way ok, or bad?

Is there a better way?

What is a good, simple way to implement this? If someone knows of an example
application somewhere, I'd be happy to see that link.

Oct 16 '07 #1

Subscribe Reply

1541

Anthony Jones

"jp2code" <poojo.com/mailwrote in message
news:up**************@TK2MSFTNGP02.phx.gbl...

I've got some files that are not very sensitive. Mostly history files from
email sessions using our contact forms.

I'd like to password protect these files so that if someone happened to

get

a link to it, they couldn't start passing it all around for anyone to

read,

and I certainly wouldn't want the link to find its way into a Google

search!

>
I've thought about creating a password string that I could hold in the <%
[code] %portion of my .asp pages. Then, if someone tries to open a

history

file, they are first prompted for a password. If it matches what is in the
<% [code] %section, they get in.

I just feel like my password is left out in the clear if I include it as
part of the asp code.

Is this way ok, or bad?

Is there a better way?

What is a good, simple way to implement this? If someone knows of an

example

application somewhere, I'd be happy to see that link.

Is this your server or is the site hosted by a third party?

On your own server it would be a simple matter of just turning off anonymous
access and turning on Windows Integrated security.
--
Anthony Jones - MVP ASP/ASP.NET

Oct 16 '07 #2

jp2code

No, it is a hosted site. The server is not mine.

"Anthony Jones" wrote:

Is this your server or is the site hosted by a third party?

Oct 16 '07 #3

Evertjan.

jp2code wrote on 16 okt 2007 in microsoft.public.inetserver.asp.general:

I've got some files that are not very sensitive. Mostly history files
from email sessions using our contact forms.

I'd like to password protect these files so that if someone happened
to get a link to it, they couldn't start passing it all around for
anyone to read, and I certainly wouldn't want the link to find its way
into a Google search!

I've thought about creating a password string that I could hold in the
<% [code] %portion of my .asp pages. Then, if someone tries to open
a history file, they are first prompted for a password. If it matches
what is in the <% [code] %section, they get in.

I just feel like my password is left out in the clear if I include it
as part of the asp code.

Is this way ok, or bad?

Is there a better way?

What is a good, simple way to implement this? If someone knows of an
example application somewhere, I'd be happy to see that link.

<META NAME="robots" CONTENT="noindex,nofollow">
<body>
<%
if request.form("pw") = "blahblah" then
session("ok")="ok"
end if
if session("ok")="" then
%>
<form method='post'>
You are out! Try to get in.<br>
<input type='password' name='pw'password<br>
<input type='submit'>
</form>
</body>
<%
response.end
end if
%>

You are in!
</body>
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

Oct 17 '07 #4

jp2code

I modified your code just a little, but that worked great!

Special thanks for the meta tag! I never would have thought to look there.

Thanks a lot!

"Evertjan." wrote:

<META NAME="robots" CONTENT="noindex,nofollow">
<body>
<%
if request.form("pw") = "blahblah" then
session("ok")="ok"
end if
if session("ok")="" then
%>
<form method='post'>
You are out! Try to get in.<br>
<input type='password' name='pw'password<br>
<input type='submit'>
</form>
</body>
<%
response.end
end if
%>

You are in!
</body>

Oct 17 '07 #5

Adrienne Boswell

Gazing into my crystal ball I observed "jp2code" <poojo.com/mail>
writing in news:Od**************@TK2MSFTNGP02.phx.gbl:

I modified your code just a little, but that worked great!

Special thanks for the meta tag! I never would have thought to look
there.

You should also use robots.txt (Google for it). Understand that
misbehaving robots may not follow directives, so it IS a very good idea
to check server side. You can also do something like:

<a href="http://www.example.com" rel="noindex, nofollow">Some offsite
URL I want to give to my visitors, but don't want robots to follow</a>

Google and Slurp follow the above directive as well as robots.txt and
meta.

>
"Evertjan." wrote:
><META NAME="robots" CONTENT="noindex,nofollow">
<body>
<%
if request.form("pw") = "blahblah" then
session("ok")="ok"
end if
if session("ok")="" then
%>
<form method='post'>
You are out! Try to get in.<br>
<input type='password' name='pw'password<br>
<input type='submit'>
</form>
</body>
<%
response.end
end if
%>

You are in!
</body>

--
Adrienne Boswell at Home
Arbpen Web Site Design Services
http://www.cavalcade-of-coding.info
Please respond to the group so others can share

Oct 18 '07 #6

jp2code

Thanks! I have implemented that as well.

"Adrienne Boswell" wrote:

You should also use robots.txt (Google for it). Understand that
misbehaving robots may not follow directives, so it IS a very good idea
to check server side. You can also do something like:

<a href="http://www.example.com" rel="noindex, nofollow">Some offsite
URL I want to give to my visitors, but don't want robots to follow</a>

Google and Slurp follow the above directive as well as robots.txt and
meta.

Oct 18 '07 #7

Similar topics

12075

How did they Hack my VB6 EXE passwords inside my APP???

by: Stone | last post by:

I have a compiled Pcode VB6 application with 1 published and 9 never-published alphanumeric string contants embedded in the program for passwords. The code simply has lines like this in a FORM...

Visual Basic 4 / 5 / 6

3298

Secure storage for passwords for admin scripts?

by: Max | last post by:

I have a collection of system admin scripts (on Win 2k) that I would like to automate the execution of. However, some of them require the use of logins with admin rights, and would therefore prefer...

Python

4271

Save passwords in scripts

by: Florian Lindner | last post by:

Hello, I've a scripts that allows limited manipulation of a database to users. This script of course needs to save a password for the database connection. The users, on the other hand need read...

Python

4041

Inserting Random Passwords into Database

by: Miranda | last post by:

Hi, I have a ASP/vbscript program that generates random passwords. The problem is I need to insert those passwords into an Access database of 327 clients. I have the random password program...

ASP / Active Server Pages

2479

scripting & psql issues

by: Dino Vliet | last post by:

Hi folks, probably this is a question you've heard so many times but I wasn't able to find a solution to it. I'm using a shell script to create a textfile for me. It looks like...

PostgreSQL Database

2453

Polyalphabetic encryption for Passwords

by: Jeremy Deuel | last post by:

Just an Idea: In PHP, passwords for different purposes often are stored plaintext in the source. I often wondered, how this could be prevented. So if you have a web-project, that is...

PHP

5072

Best place to store passwords?

by: Macca | last post by:

Hi, My application uses passwords to limit access to certain parts of the app. I was considering storing these in my database but have heard that there can be problems with this. I have heard...

C# / C Sharp

2420

Encrypting Passwords

by: Cord-Heinrich Pahlmann | last post by:

Hi, I have written a tool wich de/encrypts a few of my forum and bloggin-Passwords. My question is how secure it is. The following describes how I have encrypted my passwords. When I log in,...

PHP

2091

Checking for passwords

by: Simon.Whiteside | last post by:

If someone has created a database for me and transferred it over is there any way that I can check I have full access to all areas? I am a beginner with Access and so the development has been...

Microsoft Access / VBA

6695

Running Batch Jobs without Exposing User ID/Passwords or Source of SQL statements?!

by: John | last post by:

Hi. I have a number of batch jobs that are ran nightly on our Windows 2000 based Oracle 8.1.7 (soon to be 9i) server. I have these designed just right, so the Windows Scheduled Tasks runs them...

Oracle Database

7291

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...

C / C++

7357

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

Online Marketing

7012

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

Windows Server

5023

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

Microsoft Access / VBA

3180

Trying to create a lan-to-lan vpn between two differents networks

by: TSSRALBI | last post by:

Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The...

Networking - Hardware / Configuration

3171

Windows Forms - .Net 8.0

by: adsilva | last post by:

A Windows Forms form does not have the event Unload, like VB6. What one acts like?

Visual Basic .NET

1522

transfer the data from one system to another through ip address

by: 6302768590 | last post by:

Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated ...

C# / C Sharp

748

How to add payments to a PHP MySQL app.

by: muto222 | last post by:

How can i add a mobile payment intergratation into php mysql website.

PHP

402

Comprehensive Guide to Website Development in Toronto: Expert Insights from BSMN Consultancy

by: bsmnconsultancy | last post by:

In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence...

General