Identity Server 4 - log out - entity-framework

I follow this example on Github about Identity Server 4 and Entity Framework.
Then I follow this guide to get user from database and it works. But there is a problem during logging out user in Identity Server (http://localhost:5000/account/logout). Particularly when I return in Homepage after log out (that works) the username appear in view.
#if (!string.IsNullOrWhiteSpace(name))
{
<ul class="nav navbar-nav">
<li class="dropdown">
#name <b class="caret"></b>
<ul class="dropdown-menu">
<li><a asp-action="Logout" asp-controller="Account">Logout</a></li>
</ul>
</li>
</ul>
}
Is it an error of the source code of the guide available here? Can someone help me?

I know this is old, but I hope it helps someone.
When logging out make sure your controller does not return an action result. The logout should just be like this in your controller:
public async Task Logout()
{
await HttpContext.SignOutAsync("Cookies");
await HttpContext.SignOutAsync("oidc");
}
The callback in your identity server should redirect you back to the site.

Related

Encouter prevented webview navigation when using webview api

Hi I am using vscode webview api to show some webpages from local server
the key part (form) of the source code of the webpage is like this. It has a button and will launch a post request when clicked. therefore it can update its content
<form method="POST" action="">
<div class="form-group"><label for="start">Start Date:</label><input id="name" type="date" name="start" value="2019-01-01"
class="form-control"><label for="end">End Date:</label><input id="name" type="date" name="end" value="2019-01-04"
class="form-control"></div><button type="submit" class="btn btn-primary">generate report</button>
it works fine when opening with browser. But when launching it in vscode, nothing shows and vscode tells me it prevented webview navigation when using webview api
the part of code that using webview api is like this
public async showDetailedReport(){
const param: IRequestParam ={
endpoint:'localhost',
method:'GET',
port:23333,
path:'/report/detailReport'
};
try{
const html: string = await sendRequest(param);
const panel = vscode.window.createWebviewPanel(
'Report',
'Report',
vscode.ViewColumn.One,
{
enableScripts:true,
}
);
panel.webview.html = html;
} catch(e){
await vscode.window.showErrorMessage(e);
}
}
So my question is why that happen and how to solve it, which I mean, to send post or redirected to other webpages. Anything can be helpful. Thanks with grateful.
As of VS Code 1.31, webviews may only display a page of html content and may not navigate to other resources (such as making a POST request using a form).
You can still make requests using fetch or similar APIs, but standard POST submit form will not work.

How to safely display an email address (spamproof)

A similar question has been asked, but it was 6 years ago and there hasn't been any recent answers to the problem since then. I know the smarter way of allowing visitors to email via a website would be a contact form or a captcha to display the email address, but what about situations where the page design doesn't allow for such luxuries? My options are either display an email address or display a "click here" mailto link. Is there a more modern & unto date solution thank those in the original question?
Regards,
--Michael
So far, js remains the only efficient way of doing this.
See this long discussion for more information
Here's a sample js snipp that does the job.
<SCRIPT TYPE="text/javascript">
emailE = 'emailserver.com'
emailE = ('yourname' + '#' + emailE)
document.write('' + emailE + '')
</script>
<NOSCRIPT>
Email address protected by JavaScript
</NOSCRIPT>
a.reverse {
unicode-bidi: bidi-override;
direction: rtl;
}
<h1>Copy and paste the email below box</h1>
<span style="color:#FFF;">
<p style="color:black">Email Enquiry:</p>
<a class="reverse" style="color:blue">moc.sysartxed#ofni</a>
</span>
<div style="margin-top:20px">
<input type="text">
</div>

Unable to verify the displayed Label in Login Page

Can any one help me on this scenario.
Scenario: When user try to login the application with invalid credentials then a alert message is displayed on page it self as "Invalid login credentials" and it gets disappear by itself.
Here I am unable to capture this message for verification. I have tried as following:
msg = element(by.binding("errmsg"));
msg.tomatch('Invalid Login Credentials');
Here is the below code from where I have taken:
<div id="div_InvalidAccess" class="col-lg-8 span_new" ng-show="invalidAccess" style="display: none;">
<label id="errMsg" class="ng-binding">Invalid Login Credentials</label>
</div>

Check if user shared on Facebook [duplicate]

Is this scenario possible?
Customer goes to my website, wants to download a PDF technical document that interests them, they click the Download button and a Facebook share window appears to log them in to share it to Facebook. Once they click Share and it is posted on their wall then the download begins?
Many thanks.
Ian
UPDATE
According to a Facebook new policy, this act is not allowed. Use it at your own risk. I hold no responsibilities for using this.
Yes, using the JavaScript SDK, it provides a response (it doesn't anymore)
We will create an if statement to see if the response has a post_id if yes show the download link else do something else (alert the user, maybe?)
DEMO (API 2.0) (not working; revision required)
DEMO (API 2.7) working Rev#63
HTML
<div class="container">
<div>
<p>This file is locked, to unlock and download it, share it</p>
<p class="hidden">Thanks for sharing, the file is unlocked and ready for download</p>
<p class="hidden">In order to download this file, you need to share it</p>
</div>
<a class="fsl fsl-facebook" href="#" id="facebook-share">
<span class="fa-facebook fa-icons fa-lg"></span>
<span class="sc-label">Share on Facebook</span>
</a>
<a class="fsl content-download" href="#" id="download-file">
<span class="fa-download fa-icons fa-lg"></span>
<span class="sc-label">Download File</span>
</a>
</div>
JavaScript (jQuery)
$('#ShareToDownload').on('click', function(e) {
e.preventDefault();
FB.ui({
display: 'popup',
method: 'share',
href: location.href,
},
/** our callback **/
function(response) {
if (response && response.post_id) {
/** the user shared the content on their Facebook, go ahead and continue to download **/
$('#ShareToDownload').fadeOut(function(){ $('#downloadSection').fadeIn() });
} else {
/** the cancelled the share process, do something, for example **/
alert('Please share this page to download this file'):
}
});
});
UPDATE
With the release of API version 2.0 the Feed dialog was deprecated and replaced with the new modern Share Dialog so the above code uses the new Share Dialog
Thank you, works perfect! I Didn't know how to get the download link from a JSON file, so I did it slightly different, maybe not that safe.
Add this to the section where the response is checked
$.post('optimus.php', { 'fieldname' : 'download', 'value' : 'yes'});
Made a new page where the session is set (optimus.php)
<?php
session_start();
$_SESSION[$_POST['fieldname']] = $_POST['value'];
?>
Download.php contains the following code
<?php
session_start();
if($_SESSION['download'] == "yes"){
session_destroy();
$file = 'file.zip';
if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($file));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
ob_clean();
flush();
readfile($file);
exit;
}
} else {
echo "You didn't share, or you already downloaded the file";
}
?>
So, when the user shared something, the $_SESSION['download'] is set to yes. Download.php checks if it's yes and when it is the download is automatically started. Also, the session is destroyed so they can only download once.

Prevent form submission at all costs in Dojo

I am developing a simple Dojo application. I have a bit of a problem with my forms.
I have a form like this:
<form data-dojo-type="dijit.form.Form" data-dojo-attach-point="loginForm" method="POST">
<label for="${id}_login">Login</label>
<input name="login" id="${id}_login" data-dojo-attach-point="login" data-dojo-type="dijit.form.ValidationTextBox" data-dojo-props="required:true"/>
<label for="${id}_password">Password</label>
<input name="password" id="${id}_password0" data-dojo-attach-point="password" data-dojo-type="app.ValidationPassword" />
<input type="submit" data-dojo-attach-point="loginButton" data-dojo-type="app.BusyButton" label="Login!" />
</form>
In the app I have:
this.loginForm.onSubmit = function(e){
// Do Ajax calls etc.
// ..
// Prevents actual submission
return false;
}
However, if anything goes wrong with the Javascript before that "return false", the form is actually submitted, which results in an error (my node app will return Cannot POST /login as there is no POST action defined for that URL).
How can I make 1000% sure that the form doesn't get submitted in any case? I know I could get rid of the tag altogether since I do everything with Ajax, but... then I wouldn't get the nice data = that.loginForm.getValues(); for example. (I mean, it is a form after all)
(NOTE: I am NOT interested in non-javascript downgrading, really. The app is a 1-page ajax app, and there is no point in getting it to work if the user doesn't have AJAX) )
preventDefault will stop the browser from performing the default action (ie: submitting).
this.loginForm.onSubmit = function(e){
e.preventDefault();
// Do Ajax calls etc.
// ..
}
See here for more information.