92

First, I don't think it's realistic to expect users to have JavaScript disabled on the modern web. So let's take a look at what Panopticlick can gather through JavaScript alone, along with the uniqueness score of my particular browser: User Agent (1 in 4,184) HTTP_ACCEPT Headers (1 in 14) Browser Plugin Details (1 in 1.8 million) Time Zone (1 in 24) Screen ...


25

When you start a project and have a particular need, you have a choice: Either you implement your own solution from scratch, Or you use an existent library or framework. When implementing your own solution, you introduce several risks: The needs may evolve, requiring you to constantly write more and more code. Ultimately, the code you've originally ...


13

In the LAST_INSERT_ID() documentation it says: The ID that was generated is maintained in the server on a per-connection basis. This means that the value returned by the function to a given client is the first AUTO_INCREMENT value generated for most recent statement affecting an AUTO_INCREMENT column by that client. This value cannot be affected ...


12

You can create a User class that has nothing to do with ASP.NET Identity in your core library. public class User { public Guid UserId { get; set; } public string UserName { get; set; } public string EmailAddress { get; set; } public string EmailAddressConfirmed { get; set; } public string PhoneNumber { get; set; } public string ...


11

Browser fingerprinting relies on a very heterogeneous browser/device-ecosystem. One thing to consider is that we are moving towards a more and more homogenous ecosystem as more and more surfing is done on smartphones and tablets/pads which tend to be a lot less fragmented in this sense. IPhones/iPads will for instance all look essentially identical.


10

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? No, at best it can uniquely identity a Computer. There is no way it can differentiate between 2 new (and like) computers on the same network (Same IP) with out a cookie\session. What if you incorporate biometric data like mouse gestures or typing patterns? This ...


8

Variables are not called variables because their values may be changed, but because their value isn't known in advance – when writing the code, they are placeholders for values that will be determined later. In contrast, the value of a constant is known when the program is written. Giving that known value a name is a matter of convenience and ...


6

I would agree with @vincentcr, but would add one more environment to consider: the corporate network. Here you are likely to find many dozens or hundreds of (potential) users with the exact same browser, plugins, fonts etc. The additional factors @vincentcr suggests also fail here - IP addresses are likely to be the same if the users are behind a corporate ...


6

Yes, most places I've worked at use some of those libraries. It is tempting to see them as bloat, I for one dislike Entity Framework and tend to 'hand crank' my repositories. But, in fact the Microsoft libraries are very well written and are often complicated because they handle stuff you haven't thought of, or don't need yet. This is especially true of ...


6

You're not missing anything. To get the most up to date state, you need to query it (and even that will be delayed by the latency of your request). Caching it, or waiting for some event/message means you're necessarily working with potentially stale state. Technically, you get to decide what trade-off to make. Querying every time minimizes the stale time ...


5

If the requirements tell me to store what appears to be duplicate information, then I would store it as such in my object and/or database. However, unless the requirements also say that I must collect the email address twice (once as user name and separately as part of the contact information), I would ask the user only once and internally copy the ...


5

The self link is also used for embedded entities where it can be used to navigate to the proper entity. See this HAL example: { "_links": { "self": { "href": "/orders" }, "curies": [{ "name": "ea", "href": "http://example.com/docs/rels/{rel}", "templated": true }], "next": { "href": "/orders?page=2" }, "ea:find": { ...


5

Security doesn't come from the client, but in how you implement your web service. Ensuring that you only accept transactions from your own client does little to improve security. Safe web service operation requires that the service operate independently from the client, and that there are no service APIs that can cause harm to the service or other users of ...


5

The point of using frameworks compared to hand-rolled solutions is to save work and to reduce risk. A hand rolled custom solution might be more focused and have "less bloat" compared to a generic framework, but it will also: Have more bugs - which only you can fix Have worse documentation, no books or tutorial etc. You cannot google for solutions to common ...


4

Even if there are a huge number of combinations, they are not all distributed evenly. Think how many people on, say, a macbook, will just use the stock configuration. Or those who never install any plugin: I suspect those are the majority of users. And at the extreme end, you have the fastest growing segment of devices: mobile phone and tablet users, ...


4

As written, your requirements seem clear: there is a separate field for a user name, and a separate field for the e-mail address. This being said, you may need to discuss the requirements with the person who have written them in the first place: It may appear that, indeed, there is a clear separation required between the contact info and the authentication ...


3

Using browser fingerprinting you can identify an individual user on the web, and the only drawback is that you need to make javascript compulsory for every user. It work on two principles: Detect the browser fingerprint based on 8 parameters Detect if someone has changed his fingerprint by changing any parameter. The success of fingerprinting depends ...


3

Lambda calculus has no "data flow" allegory, but has data transformation. Imperative world hasn't data flow either, but has computation flow. Monadic way combines both of the best of two worlds: data transformation and explicit computation (order). And we can say "given monads encapsulates a computation"


3

A claim is simply a fact about a user that can potentially be used to identify or authorize someone in your system. Those two constraints should be enough to limit what you would put as a claim. Some ideas for claims include: user id user name user email roles group memberships The user's metadata should be limited to what is needed to personalize the ...


3

Is there a unique android ID question gives a good overview of the options to get a unique id for android. Best practices for Unique Identifiers recommends using instanceID for most use cases. See IdentifierForVendor for iOS products. Once you have an ID, hash it and send the hash to the webapi over a secure connection. This does not protect against rooted ...


2

There is nothing wrong in doing that. Imagine a list of messages which are shown to some groups of users only: one person would see a specific response, another one will see more messages; an administrator will probably see every possible message; a guest won't see anything. You should be careful though. If the form of the response changes radically and ...


2

Some browsers can also be identified via HSTS Supercookies. This is where you can embed a page with requests to random sets of secure and non secure resources for each visitor, then monitor the pattern of their requests on a returning visit. If each resource is requested in the same pattern, then you can use that information to identify the user. These are ...


2

I dont know EF, but Hibernate and Doctrine. I assume they are very similar. EF keeps a reference to the object. When Add(Object) is called, EF keeps a reference to the object in any case (it is needed to detect changes). When SaveChanges(), is called, EF goes through all the references it has stored. It sees the User instance and knows that the PK ...


2

In the past, the design I have pushed for when having the luxury of designing this from scratch is to have a Person entity having one or more User entities. This way you can identify unique people in the system and provide the ability for multiple user accounts that can be tied to individual applications or systems, if that's needed. This doesn't take into ...


2

Designing a login form in 2016 I would take into consideration passwordless scenarios which are well recapped in this question, plus the basic teachings of data design: ask the user only what you really need to ask. So for your specific problem I'd stay only with an email - the user email and I would never call it anything else than email, there is no "...


2

The fact that the data store lies behind a RESTful API is irrelevant if your have an architecture that doesn't care about how the data is persisted. It only needs to know about an interface that promises that persistence. The Repository pattern excels at creating this abstraction. Keep in mind that if you keep your interfaces small, it would be easy to ...


2

Point by point: If it makes business sense, stick to printable ASCII in your SKUs. Having a predefined character set (e.g. digits, letters, a limited set of punctuation) is a good idea. Allowing URL-sensitive characters like & or ? or + is likely not. Line breaks and tabs are highly dubious; think about whitespace stripping and other normalizations ...


2

Like most things in life generally and software development in particular it is a trade off. Lots of stuff you don't need and don't understand (or even why it is there) gets included in even the smallest of projects as the price of having standard things done properly and there being a large community of developers that is familiar with the environment and ...


2

Security From a security standpoint, the best practices regarding prevention of users somehow retrieving sensitive information in the server memory is always applicable. This includes showing a list of all users to impersonate before the user in question has been authenticated. Otherwise, there is no best approach here. Architecture From an architecture ...


2

You should create an id of your own for the user - and use that to request tokens from the ID server. If you store those tokens in multiple services, you'll have multiple to update on expirations and other changes of such tokens. Store them in one spot, and make other services request them. This also allows you to make authorization control over which ...


Only top voted, non community-wiki answers of a minimum length are eligible