java - How do I verify that the ETag is valid if the user does not pass If-None-Match? -

-

my first time ever hearing of 'etag'. have been able determine system i'm on, system uses etags validate item being submitted has not been altered prior submission of changes. if user has modified item system responds etag invalid. users using rest services had been created project , have not been altered in couple years. i'm working on jira based java application has rest services plugins.

now in regards etag, i'm @ loss here. our security scan on system marks header etag risk injection of code. perhaps i'm over-thinking but,

  1. is etag created , set code in application or created tomcat server?
  2. am take value of etag , compare make sure valid?
  3. how validate value etag valid?
  4. where validation occur if if-none-match provided request?
  5. how protect injection?

i've been reading posts on forum things dealing etag i'm not understanding what/how etag step 1 whatever last step is.

could use reference how i'm code this.

listing resources find:

is etag created , set code in application or created tomcat server?

if server tomcat , request static file on tomcat server, yes, created tomcat. if server apache httpd , request static file, yes. etag calculation algorithm of tomcat , apache httpd differs. there no standard specification etag calculation.

if request not static file, etag can/may added response http header.

am take value of etag , compare make sure valid?

as client side, can compare etag value other http response's (usually of same url).

as server side, can compare if-non-match should responded etag value. if value matches, should respond http 304.

how validate value etag valid?

usually server validates etag. can calculate etag value every each request. more usual etag values cached on server.

where validation occur if if-none-match provided request?

it depends on server implementation.

how protect injection?

etag value not inject anything. can used http request tracking cookie. see this article.


Comments

Post a Comment

Popular posts from this blog

python - TypeError: start must be a integer -

-
i trying draw 5 turtles, getting typeerror on line 25. here code: import turtle wn = turtle.screen() redrose = turtle.turtle() color = input("what background color be?") fillcolor_f = input("what color of rose be?") redrose.hideturtle() redrose.speed(30) redrose.penup() redrose.left(180) redrose.forward(175) redrose.right(90) redrose.forward(30) redrose.right(90) redrose.pendown() def drawrose(red): redrose.color("pink") redrose.fillcolor(fillcolor_f) redrose.fill(true) in range(red): redrose.forward(i) redrose.right(49) in range(5): drawrose(redrose) redrose.penup() redrose.forward(350) redrose.right(144) redrose.pendown() redrose.fill(false) drawrose(50) wn.bgcolor(color) i trying draw 5 roses, produces errors. doing in interactivepython.org. you recursively calling drawrose wrong parameter. on line 23 ( for in range(red): ) expect red integer...
Read more

c# - DevExpress RepositoryItemComboBox BackColor property ignored -

-
i have following code almost works properly; private void cbstatus_drawitem(object sender, listboxdrawitemeventargs e) { string item = e.item string; if (item != null) { switch (item) { case "1": e.appearance.forecolor = color.green; e.appearance.backcolor = color.green; break; case "2": e.appearance.forecolor = color.orange; e.appearance.backcolor = color.orange; break; case "3": e.appearance.forecolor = color.red; e.appearance.backcolor = color.red; break; } } } when dropdown shown, items forecolor correct, backcolor remains whatever backcolor of theme is; i.e. if i've got set dark theme, backcolor dark, cells in gridview, rather being green/orange/red. i've tried setting e.appearance.options.usebackcolor trying set e....
Read more

django - Creating multiple model instances in DRF3 -

-
1) create multiple model instances 1 api call, asked here: how create multiple model instances django rest framework? tried solution named in link, no success. i trying upload multiple files in 1 api call. result: files uploaded (only once overwrote perform_create) 1 instance created (if send 2 files, latter created instance). my code: class fileuploadserializer(serializers.modelserializer): def __init__(self, *args, **kwargs): many = kwargs.pop('many', true) super(fileuploadserializer, self).__init__(many=many, *args, **kwargs) class meta: model = fileupload read_only_fields = ('created', 'datafile', 'owner') class fileuploadviewset(viewsets.modelviewset): queryset = fileupload.objects.all() serializer_class = fileuploadserializer parser_classes = (multipartparser, formparser, ) def perform_create(self, serializer): file_list = self.request.data.getlist('file') ...
Read more