You typically use delegated permissions when you want to call the Web API as the logged on user. Say for example that the Web API needs to filter the data it returns based on who the user is, or execute some action as the logged in user. Or even just to log which user was initiating the call.

Application permissions are used when the application calls the API as itself. For example to get the weather forecast for a certain zipcode (it does not matter which user is logged on). The client can even call the API when there&#39;s no user present (some background service calling the API to update some status).

From the documentation here: [Configure a client application to access web APIs][1]:

&gt;  - **Application Permissions**: Your application needs to access the web API directly as itself (no user context). This type of permission
&gt; requires administrator consent and is also not available for native
&gt; client applications.
&gt;  - **Delegation Permissions**: Your application needs to access the web API as the signed-in user, but with access limited by the selected
&gt; permission. This type of permission can be granted by a user unless
&gt; the permission is configured as requiring administrator consent.

Based on this if your application requires user impersonation, then you would need to use Delegation permissions.


  [1]: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-integrating-applications#configure-a-client-application-to-access-web-apis

I want to start new django project in already existing folder and obviously get 

    CommandError: &#39;/home/user/projectfolder&#39; already exists.

Is there some way to force startproject command to create project in an existing folder? I have some important data in that folder and also git folder so I don&#39;t want to move it somewhere and then move it back.

Force django-admin startproject if project folder already exists

The command ``git shortlog -sne`` is exactly what I need, but I want to be able to specify a date range for that which isn&#39;t an option for `shortlog`. Is there another way to accomplish this same thing, but for a specific date range?

How to count git commits per user in a date range?

I am creating an Azure AD app and noticed there are two permissions types, Application Permissions and Delegated Permissions.  What is the difference between the two and under what scenario should I use them?

Azure AD App Application Permissions vs Delegated Permissions

<p>I am creating an Azure AD app and noticed there are two permissions types, Application Permissions and Delegated Permissions.  What is the difference between the two and under what scenario should I use them?</p>


How I add new endpoints to my VM on new azure portal (preview)?

on old portal it was easy and there is tab for it, but with new one I can&#39;t find it.

[![enter image description here][1]][1]


  [1]: http://i.stack.imgur.com/xGrKA.png

How I add new endpoints to my VM on new azure portal (preview)?

I feel guilty asking a question like this around here, but I&#39;m at a loss and would appreciate some help.

A proof-of-concept like web application was built on one PC and put up on a repo to download on another PC at a different location. There was originally an auto-build feature set up where Azure would build and publish automatically on check-in, but that was removed. Things were working on both ends until one side included a bulk of excluded changes. Now I&#39;m seeing the following error:

&gt; The &quot;Microsoft.CodeAnalysis.BuildTasks.Csc&quot; task could not be        
&gt; loaded from the assembly
&gt; ...\packages\Microsoft.Net.Compilers.1.0.0\build\..\tools\Microsoft.Build.Tasks.CodeAnalysis.dll.
&gt; Could not load file or assembly
&gt; &#39;file:///...\packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.Build.Tasks.CodeAnalysis.dll&#39;
&gt; or one of its dependencies. The system cannot find the file specified.
&gt; Confirm that the &lt;UsingTask&gt; declaration is correct, that the assembly
&gt; and all its dependencies are available, and that the task contains a
&gt; public class that implements Microsoft.Build.Framework.ITask.

Does anyone have any suggestions on where to begin looking for the issue?


BuildTasks.Csc task could not be loaded from the assembly?

Is it possible to rename an **App Service Plan**? 

I have already tried in both the old and new portals and can&#39;t find any rename options.

Is it possible to rename an Azure App Service plan using the Azure Portal?

Azure has `Storage accounts` and `Storage accounts (classic)` in the Azure Portal.

What are the differences between them? Is there any reason to migrate from a classic storage account to a new storage account?

Difference between new and classic storage accounts in Azure

For numerous time it has happened that our DevOps guys have created a Azure WebApp with incorrect URL. 

Which forced us the delete the resource group (as group contains web app, sql azure etc.) And re-create.


Is there a way to re-name /update the Web App URL via powershell Azure API or some hidden azure portal feature?

How to rename the Azure WebApp URL

There are numerous online resources which provide JavaScript APIs to access their services. To be more clear, I will base my question on the example of [MapBox][1], but this applies well to many other services in various domains.

When someone wants to use such a service in a web application (like the map imagery from MapBox for example), they typically need to Register/Sign Up and obtain an **access token** to access the service. 

Now, if I would use the API from the server side - there is no issue: I know my token is stored securely somewhere on the server and is only exposed upon communication between my server and the service provider, which is OK as long it is HTTP**S**. However, in case of a JavaScript API (for example if I use [Leaflet][2] to render a map from MapBox), I am supposed to have **my access token** in a JavaScript which is exposed to the user&#39;s web browser - and so it makes it extremely easy to find someone&#39;s access token. My users, or in a case of a public service, literally anyone, would be able to find the token in the browser&#39;s &quot;Dev Tools&quot;. 

This token however, as for me, should be considered as a sensetive data - service usage is tracked based on the authentication this token provides. If you pay for the service based on its usage it becomes critical, but even if you don&#39;t (like, if you use a Free/Starter/Non Paid plan) - service usage is limited and I&#39;d like to be sure it is only me who uses it. 

Is my only option a proxy via my own web server?

Is there a way to secure the access token used by a JavaScript API to access an external service, provided that JavaScript is executed in a user&#39;s browser?


  [1]: http://www.mapbox.com
  [2]: http://leafletjs.com/

How to secure the JavaScript API Access Token?

I&#39;m using `AES/GCM/NoPadding` encryption in Java 8 and I&#39;m wondering whether my code has a security flaw.  My code seems to *work*, in that it encrypts and decrypts text, but a few details are unclear.

My main question is this:

    Cipher cipher = Cipher.getInstance(&quot;AES/GCM/NoPadding&quot;);
    cipher.init(Cipher.ENCRYPT_MODE, key);
    byte[] iv = cipher.getIV(); // ?????

**Does that IV satisfy the requirement of &quot;For a given key, the IV MUST NOT repeat.&quot; from [RFC 4106](https://www.rfc-editor.org/rfc/rfc4106#section-3.1)?**

I&#39;d also appreciate any answers / insight for my related questions (see below), but that first question is bugging me the most.  I don&#39;t know where to find source code or documentation that answers this.

--------------------

Here is the full code, roughly.  I apologize in case I introduced errors while writing this post:

    class Encryptor {
      Key key;

      Encryptor(byte[] key) {
        if (key.length != 32) throw new IllegalArgumentException();
        this.key = new SecretKeySpec(key, &quot;AES&quot;);
      }

      // the output is sent to users
      byte[] encrypt(byte[] src) throws Exception {
        Cipher cipher = Cipher.getInstance(&quot;AES/GCM/NoPadding&quot;);
        cipher.init(Cipher.ENCRYPT_MODE, key);
        byte[] iv = cipher.getIV(); // See question #1
        assert iv.length == 12; // See question #2
        byte[] cipherText = cipher.doFinal(src);
        assert cipherText.length == src.length + 16; // See question #3
        byte[] message = new byte[12 + src.length + 16]; // See question #4
        System.arraycopy(iv, 0, message, 0, 12);
        System.arraycopy(cipherText, 0, message, 12, cipherText.length);
        return message;
      }

      // the input comes from users
      byte[] decrypt(byte[] message) throws Exception {
        if (message.length &lt; 12 + 16) throw new IllegalArgumentException();
        Cipher cipher = Cipher.getInstance(&quot;AES/GCM/NoPadding&quot;);
        GCMParameterSpec params = new GCMParameterSpec(128, message, 0, 12);
        cipher.init(Cipher.DECRYPT_MODE, key, params);
        return cipher.doFinal(message, 12, message.length - 12);
      }
    }

Suppose that users cracking my secret key = game over.

--------------------

More detailed questions / related questions:

1. Is the IV returned by cipher.getIV() safe for me to use in this way?
  - Does it avoid the catastrophe of reusing the IV,key combination in Galois/Counter Mode?
  - Is it still safe when I have multiple applications running this code at once, all displaying encrypted messages to users from the same src data (possibly in the same millisecond)?
  - What&#39;s the returned IV made of?  Is it an atomic counter plus some random noise?
  - Do I need to avoid `cipher.getIV()` and construct an IV myself, with my own counter?
  - Is the source code implementing `cipher.getIV()` available online somewhere, assuming I&#39;m using Oracle JDK 8 + JCE Unlimited Strength extension?

2. Is that IV always 12 bytes long?

3. Is the authentication tag always 16 bytes (128 bits) long?

4. With #2 and #3, and the lack of padding, does that mean my encrypted messages are always `12 + src.length + 16` bytes long?  (And so I can safely squish them into one byte array, for which I know the correct length?)

5. Is it safe for me to display an unbounded number of src data encryptions to users, given constant src data that the users know?

6. Is it safe for me to display an unbounded number of src data encryptions to users, if the src data is different every time (e.g. including `System.currentTimeMillis()` or random numbers)?

7. Would it help if I padded the src data with random numbers before encryption?  Say 8 random bytes in front and back, or only on one end?  Or would that not help at all / make my encryption worse?

(Because these questions are all about the same block of my own code, and they are strongly related to each other, and others might/should have the same set of questions when implementing the same functionality, it felt wrong to split the questions into multiple posts.  I can re-post them separately if that is more appropriate for StackOverflow&#39;s format.  Let me know!)

How are the IV and authentication tag handled for &quot;AES/GCM/NoPadding&quot;?

My website has been experiencing a denial of service/hack attack for the last week.  The attack is hitting our web API with randomly generated invalid API keys in a loop.

I&#39;m not sure if they are trying to guess a key (mathematically impossible as 64bit keys) or trying to DOS attack the server.  The attack is distributed, so I cannot ban all of the IP address, as it occurs from hundreds of clients.

My guess is that it is an Android app by the IPs, so someone has some malware in an Android app, and use all the installs to attack my server.

Server is Tomcat/Java, currently the web API just responds 400 to invalid keys, and caches IPs that have made several invalid key attempts, but still needs to do some processing for each bad request.

Any suggestions how to stop the attack?  Is there any way to identify the Android app making the request from the HTTP header?


How to stop hack/DOS attack on web API

Is it safe to put a jwt (json web token) into the url as a query parameter of a GET request?

Is it safe to put a jwt into the url as a query parameter of a GET request?

I read this on the React tutorial. What does this mean? 

&gt; React is safe. We are not generating HTML strings so XSS protection is the default.

How do XSS attacks work if React is safe? How is this safety achieved?

What does it mean when they say React is XSS protected?

I have the following code which was working when I was using 
**System.IdentityModel.Tokens.Jwt, Version=4.0.20622.1351**

    private static void ConfigureAzureAD(IAppBuilder appBuilder)
    {
        appBuilder.UseWindowsAzureActiveDirectoryBearerAuthentication(
            new WindowsAzureActiveDirectoryBearerAuthenticationOptions
            {
                Tenant = ConfigurationManager.AppSettings[&quot;ida:Tenant&quot;],
                TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidAudience = ConfigurationManager.AppSettings[&quot;ida:Audience&quot;]
                }
            });
    }


However as soon as I upgraded this package to the latest one which is [version 5][1] it no longer compiles complaining 
Reference to type &#39;TokenValidationParameters&#39; claims it is defined in System.IdentityModel.Token.Jwt but it could not be found. 

Also if you try the following compiler will warn you that **Audience is obsolete**:

   

     private static void ConfigureAzureAD(IAppBuilder appBuilder)
        {
            appBuilder.UseWindowsAzureActiveDirectoryBearerAuthentication(
                new WindowsAzureActiveDirectoryBearerAuthenticationOptions
                {
                    Tenant = ConfigurationManager.AppSettings[&quot;ida:Tenant&quot;],
                    Audience = ConfigurationManager.AppSettings[&quot;ida:Audience&quot;]
                });
        }

I downgraded this DLL again and used  the version 4.0.20622.1351, it started compiling. 

Has there been a syntax change for Configuring the Azure Active Directory? 

On Github I could not find a single project using the latest package 5.0.0 and all of them are using the previous package 4.0.20622.1351. Can anyone shed some light on this using the latest **System.IdentityModel.Tokens.Jwt 5.0.0** or direct me to some project on Github using the latest package?


  [1]: https://www.nuget.org/packages/System.IdentityModel.Tokens.Jwt/


TokenValidationParameters no longer working after upgrade to 5.0.0

I am using ADAL library to get access token for a resource. Does anyone know what format is the expiration time in ? more specifically 
`&quot;exp&quot; (Expiration time) claim`. 

`JwtSecurityToken` class simply returns int32 after parsing. So, that is not a good indicator.

Tried parsing it to `TimeSpan` and `DateTime` but the values are not 90 minutes apart. It&#39;s almost the same.

This is what I get from fiddler for `iat` and `exp` claim (used https://jwt.io/ to parse the token)

`iat`: 1475874457

`exp`: 1475878357

The values are not that much apart.


What format is the exp (Expiration Time) claim in a JWT

I am struggling to distinguish how an Azure Subscription and an Azure tenant are different? I have tried figuring it out using examples but each time I come to the conclusion that they are the same thing in a way? If a tenant is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service, then is that not what a subscription is too?

What is the difference between an Azure tenant and Azure subscription?

&gt; AADSTS70005: response_type &#39;id_token&#39; is not enabled for the
&gt; application

I am getting above error even after setting `&quot;oauth2AllowImplicitFlow&quot;: true`, in manifest.

AADSTS70005: response_type &#39;id_token&#39; is not enabled for the application

I&#39;m getting this error after I sign into my Azure website:

&gt; AADSTS50194: Application &#39;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxx&#39; is not configured as a multi-tenant application. Usage of the /common endpoint is not supported for such applications created after &#39;10/15/2018&#39;. Use a tenant-specific endpoint or configure the application to be multi-tenant.

Content Type	Original Author	Original Content on Stackoverflow
Question	Arjuna	View Question on Stackoverflow
Solution 1 - Azure	MvdD	View Answer on Stackoverflow
Solution 2 - Azure	Gaurav Mantri	View Answer on Stackoverflow

Azure AD App Application Permissions vs Delegated Permissions

Azure Problem Overview

Azure Solutions

Solution 1 - Azure

Solution 2 - Azure

How to count git commits per user in a date range?

Force django-admin startproject if project folder already exists

Attributions