You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by TG <ta...@hotmail.com> on 2012/11/21 17:55:41 UTC
Disabling HMAC check
Our app does not need this, we have our own timeout check. This check
interfere with ours. How do we disable this without getting the warning on
the screen?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Error message is "The symbol 'tapestry.hmac-passphrase' has not been
configured. This is used to configure hash-based message authentication of
Tapestry data stored in forms, or in the URL. You application is less
secure, and more vulnerable to denial-of-service attacks, when this symbol
is not configured.
"
We just want to get rid of the above message.
If we add the following (copied from one of the user's reply at
http://tapestry.1045711.n5.nabble.com/hmac-sample-td5716873.html -
configuration.add(SymbolConstants.HMAC_PASSPHRASE, new
BigInteger(130, new SecureRandom()).toString(32));
The session timeout frequentlly, as soon as less than 1 minute with error
message like your HMAC id is different from whatever, which is not helpfui
as the users are still working on the form. We need to fill out a lot of
information in the HTML form, before submitting :)
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718162.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Error message is "The symbol 'tapestry.hmac-passphrase' has not been
configured. This is used to configure hash-based message authentication of
Tapestry data stored in forms, or in the URL. You application is less
secure, and more vulnerable to denial-of-service attacks, when this symbol
is not configured.
"
We just want to get rid of the above message.
If we add the following (copied from one of the user's reply at
http://tapestry.1045711.n5.nabble.com/hmac-sample-td5716873.html -
configuration.add(SymbolConstants.HMAC_PASSPHRASE, new
BigInteger(130, new SecureRandom()).toString(32));
The session timeout frequentlly, as soon as less than 1 minute with error
message like your HMAC id is different from whatever, which is not helpfui
as the users are still working on the form. We need to fill out a lot of
information in the HTML form, before submitting :)
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718161.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Works like a charm. Thanks guy!
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718212.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by Bob Harner <bo...@gmail.com>.
But please don't use "rIbShOefrOze77SPy12niBS" since that particular string
is no longer private. Make up one of your own.
On Wed, Nov 21, 2012 at 8:44 PM, angelochen <an...@yahoo.com.hk>wrote:
> I was the one asking that question before, I am using this:
>
> configuration.add(SymbolConstants.HMAC_PASSPHRASE,
> "rIbShOefrOze77SPy12niBS");
>
> any string should work.
>
>
> TG wrote
> > Non-random string? How do I do that?
>
>
>
>
>
> --
> View this message in context:
> http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718176.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
Re: Disabling HMAC check
Posted by angelochen <an...@yahoo.com.hk>.
I was the one asking that question before, I am using this:
configuration.add(SymbolConstants.HMAC_PASSPHRASE,
"rIbShOefrOze77SPy12niBS");
any string should work.
TG wrote
> Non-random string? How do I do that?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718176.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by Bob Harner <bo...@gmail.com>.
1) http://www.random.org/strings/ will generate a random string for you if
you can't think of one on your own
2) Put that string into your AppModule class.
configuration.add(SymbolConstants.HMAC_PASSPHRASE,
the-random-string-goes-here);
On Wed, Nov 21, 2012 at 8:09 PM, TG <ta...@hotmail.com> wrote:
> Non-random string? How do I do that?
>
>
>
> --
> View this message in context:
> http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718173.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Non-random string? How do I do that?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718173.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by Thiago H de Paula Figueiredo <th...@gmail.com>.
On Wed, 21 Nov 2012 19:57:11 -0200, TG <ta...@hotmail.com> wrote:
> Yes, it expires the session. How do I disable the warning?
Have you tried a non-random string?
--
Thiago H. de Paula Figueiredo
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Yes, it expires the session. How do I disable the warning?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718170.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by Alex Kotchnev <ak...@gmail.com>.
This was discussed previously on the list, but having a random string would
be a bad idea, especially if you do some kind of load balancing between
servers (e.g. server1 would get a different passphrase from server2, and
server 2 will not want to process form submissions from server 1).
I don't think the hmac passphrase does anything to change your session
expiration.
Cheers - Alex K
On Wed, Nov 21, 2012 at 4:13 PM, TG <ta...@hotmail.com> wrote:
> Error message is "The symbol 'tapestry.hmac-passphrase' has not been
> configured. This is used to configure hash-based message authentication of
> Tapestry data stored in forms, or in the URL. You application is less
> secure, and more vulnerable to denial-of-service attacks, when this symbol
> is not configured.
> "
>
> We just want to get rid of the above message.
>
> If we add the following (copied from one of the user's reply at
> http://tapestry.1045711.n5.nabble.com/hmac-sample-td5716873.html -
>
> configuration.add(SymbolConstants.HMAC_PASSPHRASE, new
> BigInteger(130, new SecureRandom()).toString(32));
>
> The session timeout frequentlly, as soon as less than 1 minute with error
> message like your HMAC id is different from whatever, which is not helpfui
> as the users are still working on the form. We need to fill out a lot of
> information in the HTML form, before submitting :)
>
>
>
> --
> View this message in context:
> http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718163.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Error message is "The symbol 'tapestry.hmac-passphrase' has not been
configured. This is used to configure hash-based message authentication of
Tapestry data stored in forms, or in the URL. You application is less
secure, and more vulnerable to denial-of-service attacks, when this symbol
is not configured.
"
We just want to get rid of the above message.
If we add the following (copied from one of the user's reply at
http://tapestry.1045711.n5.nabble.com/hmac-sample-td5716873.html -
configuration.add(SymbolConstants.HMAC_PASSPHRASE, new
BigInteger(130, new SecureRandom()).toString(32));
The session timeout frequentlly, as soon as less than 1 minute with error
message like your HMAC id is different from whatever, which is not helpfui
as the users are still working on the form. We need to fill out a lot of
information in the HTML form, before submitting :)
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718163.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by TG <ta...@hotmail.com>.
Error message is "The symbol 'tapestry.hmac-passphrase' has not been
configured. This is used to configure hash-based message authentication of
Tapestry data stored in forms, or in the URL. You application is less
secure, and more vulnerable to denial-of-service attacks, when this symbol
is not configured.
"
We just want to get rid of the above message.
If we add the following (copied from one of the user's reply at
http://tapestry.1045711.n5.nabble.com/hmac-sample-td5716873.html -
configuration.add(SymbolConstants.HMAC_PASSPHRASE, new
BigInteger(130, new SecureRandom()).toString(32));
The session timeout frequentlly, as soon as less than 1 minute with error
message like your HMAC id is different from whatever, which is not helpfui
as the users are still working on the form. We need to fill out a lot of
information in the HTML form, before submitting :)
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Disabling-HMAC-check-tp5718156p5718160.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Disabling HMAC check
Posted by Massimo Lusetti <ml...@gmail.com>.
On Wed, Nov 21, 2012 at 5:55 PM, TG <ta...@hotmail.com> wrote:
> Our app does not need this, we have our own timeout check. This check
> interfere with ours. How do we disable this without getting the warning on
> the screen?
>
>
I don't get what HMAC and "timeout" have in common, would you elaborate
more?
Cheers
--
Massimo