How to sign XML using private key contained in smartcard for a web application? - x509certificate

I was looking for a solution to sign XML using unexportable private key (this require passphrase/secret password to be informed by user input for create the hash using it) contained in usb token (smartcard etc) for a web application. I have made a c# class library to make this but obviously the code is executed in server-side, so I can't access the usbtoken/smartcard of the client over internet, unless it's plugged in the server pc (so my solution may be installed in local network of my customers and the usbtoken plugged in server's usb. It's working like that today but I want to change this for the customer use its token in his machine)
I have created a code using SignedXml, X509Certificates and other classes, to achieve this, but I was looking for equivalents in silverlight class library for encapsulate all this things and execute it in client side, but unfortunately SignedXml can't be used in Silverlight (not exists..).
I have created an ActiveX for doing this successfully but my solution now only works in Internet Explorer/Windows, and it's not very easy to maintain because of my business logics.
Anyone can help me with this please? Any suggestions are very welcome.
If I can port my activex solution to silverlight, or if its possible to do that using other MS Technology that can be executed in other browser/OS.
Sorry for bad English, not a native speaker. Thank you.

Java applet is a better option than the ActiveX.
Silverlight won't give you access to certificate storages, and its development has stopped (Silverlight 5 is officially the last version).
Our company offers a ready to use solution for distributed cryptography which includes ActiveX, Java applet and Flash module for client-side activities. This solution is discussed in details in this answer.

Related

Secure http call in Microsoft Access in 2017 ... is there such a thing

I am coming from a background in Web Development. Have had some classes in MS access about 3 years ago. Currently I am working on a project primarily built using Access. Eventually the program will be expanded to interface with the same database that Access uses in the cloud. Which will then lead to development on a web project.
My question is its 2017 and I am aware that you can make web calls in Access , but just because I can doesn't mean I should right ? My client/boss would like to implement a credit card processing payment system into his Access application. However I am pushing for this to be something built from the web development side project that will take place later using an API. Any Access developers out there able to suggest whether its a good idea to wait to build this feature later when development has begun on the web project ? Is it okay or secure to make web calls using Access ? Or is there any alternatives to an existing merchant service that can interface with Access ? Any advice on this topic would be greatly appreciated. Thanks in advance.
Access (VBA) has COM support, and makes heavy use of it. Any existing merchanting solution that works with COM can work with Access.
If your desired merchant solution doesn't, you can create COM classes and libraries in C#, C++, VB.Net and probably some more programming languages.
If it's a good idea? That heavily depends on your demands. I don't know what the advantage of an Access database over a program is for you.
Note that if you're using ASP.Net for your web solution, you might use a common class to check and authorize payments, and you might want to develop both simultaneously.

Open scanner from web page (JavaEE or asp.net)

I know that you cannot access a peripheral (like the scanner) from a web page, but i saw a method for acceding "a TWAIN Scanner" using .net, but it is a paid solution and plus the use has to download and install a file before using the online scanner, and it is only limited to twain scanners (if i got it right?).
Also i saw another method, that consist of downloading a java applet (very old??), but it does not work on google chrome, and need special permission on firefox.
so my question is there any method, using JavaEE or asp.net, to let the user access the scanner from a web page??
Thank you.

How to get logical drivers from a client machine with asp

A tester came up to me and told me that a link was creating a dialog with the logical drivers from the server and the desired behavior would be that it showed drivers from the client side.
Since c# is a server side language I only believed that I need to use a client-side language.
Today this application is developed in Asp Net MVC so I went to seach such a feature in asp net.
Turns out there is nothing related to that I could find.
I found that javascript provides "FileSystemObject" that I believe I could do that, but I am looking for a solution using asp.
Any suggestion?
AFAIC, you cannot do this in C#. Software running on your server has no way to access the file system of the client computer. So you do need a client-side language such as JavaScript.
So I would try to get more information from JavaScript people, but I strongly suspect that there are severe limitations on this if it's possible at all. I don't want every website I visit to be able to access my system drives. It's a security risk.

Create web application to scan document

work on asp.net 08 C#.I would like to develop a web application that scan documents into the following format(pdf,tiff,jpg,gif.etc) .My scanned images/file will be at client computer.
Have you tried using an 3rd party scanning control such as LeadTools? I have used those controls in the past and worked wonderfully.
Brining in a scanned document through the browser goes beyond the basic functionality of the browser.
If you must stick with ASP.NET, you might consider writing an ActiveX control (IE only, I think) that can handle the scanning and interact with your web page.
You might also consider Silverlight. Although I don't think it can handle the scanning directly, you should be able to interface with COM components installed on the system to handle scanned streams.
The wording is sort of ambiguous. Is the scanner on your side or the client's side? I understand that the result of the scan is saved on your client's side.
I assume that the scanner is on the client's side...
You can't access peripherals [ie: a scanner] via standard JavaScript... You can take advantage of ActiveX for IE only.
Why not write a small winforms application in c# and let your client download that?
By the way, if the client has a scanner on his/her side, the scanner will likely have come with software to manipulate the scanner...

How to write an offline version of an AJAX/ASP.NET web application

We have a web application that uses AJAX to talk to an ASP.NET web service. We would like to write another version that can be used offline. We need to be able to re-use our existing code as much as possible. What approaches should we consider?
The app is currently using XmlHttpRequest to get dynamic data from the server. Obviously the offline version will not be able to talk to the server, but it does need to talk to something! I'm sure installing IIS or Cassini on the client would work, but I was hoping for a simpler solution. Is there no other way for JavaScript to talk to some external code?
There are plenty offline web apps nowaday. It simply evolve from AJAX.
For example:
WoaS (wiki on a stick / stickwiki), Tiddly Wiki,
Google doc and Gmail is going to be offline.
You don't need a webserver to run these webapps in offline mode. Just store the required data, scripts on the client side (usually as XML).
One of the possibilities would be to use Cassini. This is a web server that acts as a host for the ASP.Net runtime. You can host Cassini in a Windows application or a Windows Service. In this scenario you do not have to rewrite the web app and the web service.
Most other solutions do require a rewrite of both your web app and your web service. Depending on the way you have written the existing app you can reuse more or less code.
Have you considered HTML5 with application cache and offline storage?
If you hope to create an "offline" version of your package your biggest issue by far will be the need to install your site into a local copy of IIS (registering a virtual directory, etc.). I pursued this briefly a few years ago and gave up in frustration. It can be done: a number of software vendors such as DevExpress do this so you have local copies of their demonstration projects. Indeed, I was able to do this. The problem was the classic "it works on my computer" syndrome. There was simply no way to guarantee that most of my end-users had anywhere near the technical proficiency to make this work.
Thus, I would strongly recommend that you not pursue this path unless you have very technically proficient users and a huge support staff.
But there is one more very important question: did you abstract all data access code to a DAL? If not, then you have a lot of work to do in managing data access as well.
Update: user "Rine" has recommended Cassini. I just wanted to let you know that I pursued Cassini and another 3rd-party web server as well. I think that there are licensing issues with Cassini but may be wrong - it has been awhile. However, I do distinctly remember running into barrier after barrier with this approach and very little documentation to help me out.
if you want a web application run offline, you need a webserver (IIS for ASP) bound to the localhost (127.0.0.1) address. After this so can access your web application by typing http://127.0.0.1/ in your web browser the same way as you do online.
If your AJAX relies on XMLHttpRequest's, you can:
Make the static versions of XML's you get over XMLHttpRequest and put then into a folder on disk.
Rewrite your XMLHttpRequest URL's so that they point to files on disk.
Rewrite your XMLHttpRequest's so that they don't check status (it's always 0 for the file:// protocol.
All JScript works on file:// pages as well as on http:// ones.
Of course it's not the best way to develop static pages, but it may save you some time on rewriting.
I havent come across any framework specifically built for asp.net like the ones available for PHP or RoR.
Here is a good article by Steven to get you started with HTML 5 and ASP.Net Creating HTML 5 Offline application
Obviously the offline version will not be able to talk to the server, but it does need to talk to something!
Enter HTML5 LocalStorage. It works like a database and enables you to put data on your client. Indeed you have to rework parts of your code in javascript and transmit it to the client, but then it would work offline.
Local Storage works like this:
- Setter: window.localStorage.setItem(KEY, VALUE)
- Getter: window.localStorage.getItem(KEY)
- Remove: window.localStorage.removeItem(KEY)
To get the main page working offline you need to create a manifest. This is used to store complete sites on the client. Please refer to this for more information about manifests:
http://diveintohtml5.info/offline.html
You want to build a web application to work offline?? It can't be done.
You could split the interface code from the rest (in diferent dlls) and create a windows application to mimic the behaviour of your web application. This way you have 2 distinct user interfaces but the same code for business rules and data access.
I don't really see any other way...

Resources