`CookieContainer`s can hold multiple cookies for different websites, therefor a label (the Domain) has to be provided to bind each cookie to each website. The Domain can be set when instantiating the individual cookies like so:

    
    Cookie chocolateChip = new Cookie(&quot;CookieName&quot;, &quot;CookieValue&quot;) { Domain = &quot;DomainName&quot; };


An easy way to grab the domain to is to make a `Uri` (if you aren&#39;t using one already) that contains your target url and set the cookie&#39;s domain using the `Uri.Host` property.

    CookieContainer gaCookies = new CookieContainer();
    Uri target = new Uri(&quot;http://www.google.com/&quot;);

    gaCookies.Add(new Cookie(&quot;__utmc&quot;, &quot;#########&quot;) { Domain = target.Host });

For instance I have a blog post that has the following `iframe`.

    &lt;iframe width=&quot;420&quot; height=&quot;315&quot; src=&quot;//www.youtube.com/embed/1sIWez9HAbA&quot; frameborder=&quot;0&quot; allowfullscreen&gt;&lt;/iframe&gt;

How can I extract the thumbnail from this `iframe`?

How to get a YouTube thumbnail from a YouTube iframe?

I am trying to put an extra message in my intent to pass to AlarmManager to be triggered at a later time. My onReceive triggers correctly but extras.getString() returns null

Setup:

	public PendingIntent getPendingIntent(int uniqueRequestCode, String extra) {
		Intent intent = new Intent(this, ActionReceiver.class);
		intent.putExtra(&quot;EXTRA&quot;, extra);
		PendingIntent pendingIntent = PendingIntent.getBroadcast(this, uniqueRequestCode,
				intent, 0);
		return pendingIntent;
	}

	public void setSilentLater(TimeRule timeRule) {
		boolean[] weekdays = timeRule.getReoccurringWeekdays();
		int dayOfWeek = 0;

		for (boolean day : weekdays) {
			dayOfWeek++;
			if (day == true) {
				Calendar cal = Calendar.getInstance();

				AlarmManager alarmManager = (AlarmManager) this
						.getSystemService(Context.ALARM_SERVICE);

				cal.set(Calendar.DAY_OF_WEEK, dayOfWeek);
				cal.set(Calendar.HOUR_OF_DAY,
						timeRule.getStartTime().get(Calendar.HOUR_OF_DAY));
				cal.set(Calendar.MINUTE,
						timeRule.getStartTime().get(Calendar.MINUTE));
				cal.set(Calendar.SECOND, 0);
				cal.set(Calendar.MILLISECOND, 0);

				alarmManager.setRepeating(AlarmManager.RTC_WAKEUP,
						cal.getTimeInMillis(), 3600000 * 7, getPendingIntent(0, &quot;RINGER_OFF&quot;));
      }
     }
    }

When this triggers, message is empty:

    public class ActionReceiver extends BroadcastReceiver {
    
        @Override
        public void onReceive(Context context, Intent intent) {
        	 Bundle extras = intent.getExtras();
             String message = extras.getString(&quot;EXTRA&quot;); //empty        
             if(message == &quot;RINGER_OFF&quot;)
             {
    	         AudioManager am = (AudioManager) context.getSystemService(Context.AUDIO_SERVICE);
    	         am.setRingerMode(AudioManager.RINGER_MODE_SILENT);
             }
             else if(message == &quot;RINGER_ON&quot;)
             {
            	 AudioManager am = (AudioManager) context.getSystemService(Context.AUDIO_SERVICE);
    	         am.setRingerMode(AudioManager.RINGER_MODE_NORMAL);
             }
        }
    }

Android cannot pass intent extras though AlarmManager

I&#39;m trying to login to a website via my application.
What I did:

First I figured out how the browser does the authorization process with Fiddler.
I examined how the POST request is built and I tried to reconstruct it.
The browser sends 4 cookies (Google Analytics) and I tried to set them:

    CookieContainer gaCookies = new CookieContainer();
    gaCookies.Add(new Cookie(&quot;__utma&quot;, &quot;#########.###########.##########.##########.##########.#&quot;));
    gaCookies.Add(new Cookie(&quot;__utmb&quot;, &quot;#########.#.##.##########&quot;));
    gaCookies.Add(new Cookie(&quot;__utmc&quot;, &quot;#########&quot;));
    gaCookies.Add(new Cookie(&quot;__utmz&quot;, &quot;#########.##########.#.#.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&quot;));
(just replaced the original cookie data with #)

Then I went through the code with the debugger and as soon as the first gaCookies.Add is executed, the application stops with an

    System.ArgumentException: The parameter &#39;{0}&#39; cannot be an empty string. Parameter name: cookie.Domain

I would like to know why this happens. The constructor of Cookie doesn&#39;t require a domain and I don&#39;t know where I can get this value?

Would be very great if someone of you could help me with this.&lt;br&gt;
I&#39;m not a webdeveloper or an expert in web stuff so I don&#39;t know much about it.&lt;br&gt;
Is there maybe a great source where I can learn about this if there is no &quot;short and quick answer&quot;?&lt;br&gt;

HttpWebRequest: Add Cookie to CookieContainer -&gt; ArgumentException (Parametername: cookie.Domain)

I'm trying to login to a website via my application.
What I did:
First I figured out how the browser does the authorization process with Fiddler.
I examined how the POST request is built and I tried to reconstruct it.
The browser sends 4 cookies (Google Analytics) and I tried to set them:
<pre><code class="hljs language-java">CookieContainer gaCookies = new CookieContainer();
gaCookies.Add(new Cookie("__utma", "#########.###########.##########.##########.##########.#"));
gaCookies.Add(new Cookie("__utmb", "#########.#.##.##########"));
gaCookies.Add(new Cookie("__utmc", "#########"));
gaCookies.Add(new Cookie("__utmz", "#########.##########.#.#.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)"));
</code></pre>
(just replaced the original cookie data with #)
Then I went through the code with the debugger and as soon as the first gaCookies.Add is executed, the application stops with an
<pre><code class="hljs language-sql">System.ArgumentException: The parameter '{0}' cannot be an empty string. Parameter name: cookie.Domain
</code></pre>
I would like to know why this happens. The constructor of Cookie doesn't require a domain and I don't know where I can get this value?
Would be very great if someone of you could help me with this. 
I'm not a webdeveloper or an expert in web stuff so I don't know much about it. 
Is there maybe a great source where I can learn about this if there is no "short and quick answer"?

So WPF windows only have four resize mode options: `NoResize`, `CanMinimize`, `CanResize` and `CanResizeWithGrip`. Unfortunately, the options that enable resizing also enable maximizing the window, and those that don&#39;t are useless to me.

Is there an option to disable the maximize button while keeping the resize feature? 

I&#39;d prefer solutions that don&#39;t involve `WinAPI` stuff.

Disable maximize button of WPF window, keeping resizing feature intact

What are differences between these commands in C#

    string text= &quot;  &quot;;
    1-string.IsNullOrEmpty(text.Trim())

    2-string.IsNullOrWhiteSpace(text)

Difference between IsNullOrEmpty and IsNullOrWhiteSpace in C#

What&#39;s the best way to sleep a certain amount of time, but be able to be interrupted by a `IsCancellationRequested` from a `CancellationToken`?

I&#39;m looking for a solution which works in .NET 4.0.

I&#39;d like to write


    void MyFunc (CancellationToken ct)
    {
       //... 
       // simulate some long lasting operation that should be cancelable 
       Thread.Sleep(TimeSpan.FromMilliseconds(10000), ct); 
    }
    

How to &quot;sleep&quot; until timeout or cancellation is requested in .NET 4.0

I want to write an async method with an `out` parameter, like this:


    public async void Method1()
    {
        int op;
        int result = await GetDataTaskAsync(out op);
    }


How do I do this in `GetDataTaskAsync`?

How to write an async method with out parameter?

I&#39;m organizing a library project and I have a central manager class named `Scenegraph` and a whole bunch of other classes that live in the Scenegraph namespace.

What I&#39;d really like is for the scenegraph to be `MyLib.Scenegraph` and the other classes to be `MyLib.Scenegraph.*`, but it seems the only way to do that would be to make all the other classes inner classes of `Scenegraph` in the Scenegraph.cs file and that&#39;s just too unwieldy.

Instead, I&#39;ve organized it as `Mylib.Scenegraph.Scenegraph` and `MyLib.Scenegraph.*`, which sort of works but I find Visual Studio gets confused under some conditions as to whether I am referring to the class or the namespace.

Is there a good way to organize this package so it&#39;s convenient for users without glomming all my code together in an unmaintainable mess?

Namespace and class with the same name?

What are the technical pros and cons of `localStorage`, `sessionStorage`, session and `cookies`, and when would I use one over the other?

What is the difference between localStorage, sessionStorage, session and cookies?

I&#39;m looking for how to view the cookies set using developer tools in IE11. I see an option in network profiling to view cookies being sent back and forth, but this is not really the same thing. It is cumbersome to use since it&#39;s per request. Surely there must be a way to view all cookies like you can in IE10.

How do I view cookies in Internet Explorer 11 using Developer Tools

I&#39;m trying to understand the whole issue with CSRF and appropriate ways to prevent it. (Resources I&#39;ve read, understand, and agree with: [OWASP CSRF Prevention CHeat Sheet](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_$CSRF$_Prevention_Cheat_Sheet), https://stackoverflow.com/questions/9632262/questions-about-csrf.)

As I understand it, the vulnerability around CSRF is introduced by the assumption that (from the webserver&#39;s point of view) a valid session cookie in an incoming HTTP request reflects the wishes of an authenticated user. But all cookies for the origin domain are magically attached to the request by the browser, so really all the server can infer from the presence of a valid session cookie in a request is that the request comes from a browser which has an authenticated session; it cannot further assume anything about the *code* running in that browser, or whether it really reflects user wishes. The way to prevent this is to include additional authentication information (the &quot;CSRF token&quot;) in the request, carried by some means other than the browser&#39;s automatic cookie handling. Loosely speaking, then, the session cookie authenticates the user/browser and the CSRF token authenticates the code running in the browser.

So in a nutshell, if you&#39;re using a session cookie to authenticate users of your web application, you should also add a CSRF token to each response, and require a matching CSRF token in each (mutating) request. The CSRF token then makes a roundtrip from server to browser back to server, proving to the server that the page making the request is approved by (generated by, even) that server.

On to my question, which is about the specific transport method used for that CSRF token on that roundtrip.

It seems common (e.g. in [AngularJS](http://docs.angularjs.org/api/ng.$http), [Django](https://docs.djangoproject.com/en/dev/ref/contrib/csrf/), [Rails](http://guides.rubyonrails.org/security.html#csrf-countermeasures)) to send the CSRF token from server to client as a cookie (i.e. in a Set-Cookie header), and then have Javascript in the client scrape it out of the cookie and attach it as a separate XSRF-TOKEN header to send back to the server.

(An alternate method is the one recommended by e.g. [Express](http://dailyjs.com/2012/09/13/express-3-csrf-tutorial/), where the CSRF token generated by the server is included in the response body via server-side template expansion, attached directly to the code/markup that will supply it back to the server, e.g. as a hidden form input. That example is a more web 1.0-ish way of doing things, but would generalize fine to a more JS-heavy client.)

Why is it so common to use Set-Cookie as the downstream transport for the CSRF token / why is this a good idea? I imagine the authors of all these frameworks considered their options carefully and didn&#39;t get this wrong. But at first glance, using cookies to work around what&#39;s essentially a design limitation on cookies seems daft. In fact, if you used cookies as the roundtrip transport (Set-Cookie: header downstream for the server to tell the browser the CSRF token, and Cookie: header upstream for the browser to return it to the server) you would reintroduce the vulnerability you are trying to fix.

I realize that the frameworks above don&#39;t use cookies for the whole roundtrip for the CSRF token; they use Set-Cookie downstream, then something else (e.g. a X-CSRF-Token header) upstream, and this does close off the vulnerability. But even using Set-Cookie as the downstream transport is potentially misleading and dangerous; the browser will now attach the CSRF token to every request including genuine malicious XSRF requests; at best that makes the request bigger than it needs to be and at worst some well-meaning but misguided piece of server code might actually try to use it, which would be really bad. And further, since the actual intended recipient of the CSRF token is client-side Javascript, that means this cookie can&#39;t be protected with http-only. So sending the CSRF token downstream in a Set-Cookie header seems pretty suboptimal to me.

Why is it common to put CSRF prevention tokens in cookies?

I have a question regarding URLs:

I&#39;ve read the [RFC 3986][1] and still have a question about one URL:

&gt; If a URI contains an authority component, then the path component   
&gt; must either be empty or begin with a slash (&quot;/&quot;) character.  If a URI 
&gt; does not contain an authority component, then the path cannot begin   
&gt; with two slash characters (&quot;//&quot;).  In addition, a URI reference   
&gt; (Section 4.1) may be a relative-path reference, in which case the   
&gt; first path segment cannot contain a colon (&quot;:&quot;) character.  The ABNF  
&gt; requires five separate rules to disambiguate these cases, only one of 
&gt; which will match the path substring within a given URI reference.  We 
&gt; use the generic term &quot;path component&quot; to describe the URI substring   
&gt; matched by the parser to one of these rules.

I know, that `//server.com:80/path/info` is valid (it is a schema relative URL)

I also know that `http://server.com:80/path//info` is valid.

But I am not sure whether the following one is valid:

    http://server.com:80//path/info

The problem behind my question is, that a cookie is not sent to `http://server.com:80//path/info`, when created by the URI `http://server.com:80/path/info` with restriction to `/path`





  [1]: http://www.ietf.org/rfc/rfc3986.txt

Is a URL with // in the path-section valid?

I started developing a web-app with angularJS and I&#39;m not sure that everything is right secured (client and server side). 
Security is based on a single login page, if credentials are checked ok, my server sends back an unique token with custom time-validity. All other REST api are accessible through this token.
The application (client) browse to my entry-point ex: https://www.example.com/home.html user insert credentials and receive back a unique token. This unique token is stored in the server database with AES or other secure techniques, it is not stored in clear format.

From now on, my AngluarJS app will use this token to authenticate to all REST Api exposed.

I&#39;m thinking on temporary store the token in a custom http cookie; basically, when the server verifies the credentials, it sends back a new cookie Ex. 

    app-token : AIXOLQRYIlWTXOLQRYI3XOLQXOLQRYIRYIFD0T

The cookie has the [secure][1] and [HTTP Only][2] flags set on.
Http protocol directly manage the new cookie and store it. Successive requests will presents the cookie with the new parameter, without the need to manage it and store it with javascript; at every request, server invalidates the token and generates a new one and sends it back to the client --&gt; prevent replay-attacks with a single token.


When the client receives an HTTP status *401 unauthorized* response from any REST Api, the angular controller clean all the cookies and redirect the user to the login page.

Should I have to consider other aspects? Is it better to store the token inside a new cookie or in localStorage? 
Any tips on how to generate a unique strong token?

**Edit (improvements):**

 - I decided to use HMAC-SHA256 as session token generator, with 20 minutes validity. I generate a random 32byte GUID, attach a timestamp and compute the HASH-SHA256 by providing a 40 bytes key. It&#39;s quite impossible to obtain collisions since the token validity is quite minimal.
 - Cookie will have [domain and path][3] attributes to increase security.
 - No multi-logins are permitted.


  [1]: https://www.owasp.org/index.php/SecureFlag
  [2]: https://www.owasp.org/index.php/HttpOnly
  [3]: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Domain_and_Path_Attributes

Authentication with AngularJS, session management and security issues with REST Api WS

This is my first time ever using JSON as well as `System.Net` and the `WebRequest` in any of my applications. My application is supposed to send a JSON payload, similar to the one below to an authentication server:

    {
      &quot;agent&quot;: {                             
        &quot;name&quot;: &quot;Agent Name&quot;,                
        &quot;version&quot;: 1                                                          
      },
      &quot;username&quot;: &quot;Username&quot;,                                   
      &quot;password&quot;: &quot;User Password&quot;,
      &quot;token&quot;: &quot;xxxxxx&quot;
    }
To create this payload, I used the `JSON.NET` library. How would I send this data to the authentication server and receive its JSON response back? Here is what I have seen in some examples, but no JSON content:

    var http = (HttpWebRequest)WebRequest.Create(new Uri(baseUrl));
    http.Accept = &quot;application/json&quot;;
    http.ContentType = &quot;application/json&quot;;
    http.Method = &quot;POST&quot;;
    
    string parsedContent = &quot;Parsed JSON Content needs to go here&quot;;
    ASCIIEncoding encoding = new ASCIIEncoding();
    Byte[] bytes = encoding.GetBytes(parsedContent);
    
    Stream newStream = http.GetRequestStream();
    newStream.Write(bytes, 0, bytes.Length);
    newStream.Close();
    
    var response = http.GetResponse();
    
    var stream = response.GetResponseStream();
    var sr = new StreamReader(stream);
    var content = sr.ReadToEnd();

However, this seems to be a lot of code compaired to using other languages I have used in the past. Am I doing this correctly? And how would I get the JSON response back so I can parse it?

Thanks, Elite.

**Updated Code**

    // Send the POST Request to the Authentication Server
    // Error Here
    string json = await Task.Run(() =&gt; JsonConvert.SerializeObject(createLoginPayload(usernameTextBox.Text, password)));
    var httpContent = new StringContent(json, Encoding.UTF8, &quot;application/json&quot;);
    using (var httpClient = new HttpClient())
    {
        // Error here
        var httpResponse = await httpClient.PostAsync(&quot;URL HERE&quot;, httpContent);
        if (httpResponse.Content != null)
        {
            // Error Here
            var responseContent = await httpResponse.Content.ReadAsStringAsync();
        }
    }

Send JSON via POST in C# and Receive the JSON returned?

i am still new on c# and i&#39;m trying to create an application for this page that will tell me when i get a notification (answered, commented, etc..). But for now i&#39;m just trying to make a simple call to the api which will get the user&#39;s data.

i&#39;m using Visual studio express 2012 to build the C# application, where (for now) you enter your user id, so the application will make the request with the user id and show the stats of this user id.

here is the code where i&#39;m trying to make the request:

    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Text;
    using System.Threading.Tasks;
    //Request library
    using System.Net;
    using System.IO;
    
    namespace TestApplication
    {
        class Connect
        {
            public string id;
            public string type;
    
            protected string api = &quot;https://api.stackexchange.com/2.2/&quot;;
            protected string options = &quot;?order=desc&amp;sort=name&amp;site=stackoverflow&quot;;
            
            public string request()
            {
                string totalUrl = this.join(id);
    
                return this.HttpGet(totalUrl);
            }
    
            protected string join(string s)
            {
                return api + type + &quot;/&quot; + s + options;
            }
    
            protected string get(string url)
            {
                try
                {
                    string rt;
    
                    WebRequest request = WebRequest.Create(url);
                    
                    WebResponse response = request.GetResponse();
    
                    Stream dataStream = response.GetResponseStream();
    
                    StreamReader reader = new StreamReader(dataStream);
    
                    rt = reader.ReadToEnd();
    
                    Console.WriteLine(rt);
    
                    reader.Close();
                    response.Close();
    
                    return rt;
                }
    
                catch(Exception ex)
                {
                    return &quot;Error: &quot; + ex.Message;
                }
            }
            public string HttpGet(string URI)
            {
                WebClient client = new WebClient();
    
                // Add a user agent header in case the 
                // requested URI contains a query.
    
                client.Headers.Add(&quot;user-agent&quot;, &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705;)&quot;);
    
                Stream data = client.OpenRead(URI);
                StreamReader reader = new StreamReader(data);
                string s = reader.ReadToEnd();
                data.Close();
                reader.Close();
    
                return s;
            }
        }
    }

the class is an object and its being accessed from the form by just parsing it the user id and make the request.

i have tried many of the examples i have looked on google, but not clue why i am getting on all ways this message &quot;�&quot;.

i am new in this kind of algorithm, if anyone can share a book or tutorial that shows how to do this kind of stuff (explaining each step), i would appreciate it

How to properly make a http web GET request

My application connects to Experian server and Experian will soon stop supporting TLS 1.0 and TLS 1.1. All connectivity using HTTPS must use TLS Version 1.2.

I want to do some research on that issue and see sending `HttpWebRequest` using TLS 1.2 on .NET 4.0 framework works

If it does not, I will probably need to create a `webservice` on .NET 4.5 and call its methods, if it does, I do not have to anything.

Has anyone already faced with that issue? 
  

 

Is that possible to send HttpWebRequest using TLS1.2 on .NET 4.0 framework

I need to upgrade a .NET application to support a call to an API on a website that only supports TLS 1.2. From what I read, if the application is targeting 4.6 or higher then it will use TLS 1.2 by default. 

To test I created a Windows Forms app that targets 4.7. Unfortunately it errors when I don&#39;t explicitly set ServicePointManager.SecurityProtocol. Here is the code:

    HttpClient _client = new HttpClient();
    
    var msg = new StringBuilder();
    
    // If I uncomment the next line it works, but fails even with 4.7
    // ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    
    var httpWebRequest = (HttpWebRequest)WebRequest.Create(&quot;https://sandbox.authorize.net&quot;);
    
    httpWebRequest.KeepAlive = false;
    
    try
    {
        var httpWebResponse = (HttpWebResponse) httpWebRequest.GetResponse();
    
        msg.AppendLine(&quot;The HTTP request Headers for the first request are: &quot;);
    
        foreach (var header in httpWebRequest.Headers)
        {
            msg.AppendLine(header.ToString());
        }
    
        ResponseTextBox.Text = msg.ToString();
       
    }
    catch (Exception exception)
    {
       ResponseTextBox.Text = exception.Message;
     
       if (exception.InnerException != null)
       {
           ResponseTextBox.Text += Environment.NewLine + @&quot;  -&gt;&quot; + exception.InnerException.Message;
    
           if (exception.InnerException.InnerException != null)
           {
                ResponseTextBox.Text += Environment.NewLine + @&quot;     -&gt;&quot; + exception.InnerException.InnerException.Message;
           }
       }
    }

If you uncomment out the following line:
  

    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

it works. This isn&#39;t a good solution since it hard codes what TLS version to use, so it wouldn&#39;t use TLS 1.3 in future.

What else do I need to do to get it work without having this line. I&#39;m testing from a Window 10 machine with 4.7 installed. 

**Update**

I tried a test with HttpClient and had the same results, I had to explicitly set SecurityProtocol. 

Code: 

    var msg = new StringBuilder();
    
    // Need to uncomment code below for TLS 1.2 to be used
    // ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    
    try
    {
       var response = await _client.GetAsync(@&quot;https://sandbox.authorize.net&quot;);
    
       msg.AppendLine(&quot;response.IsSuccessStatusCode : &quot; + response.IsSuccessStatusCode);
    
       msg.AppendLine(await response.Content.ReadAsStringAsync());
    
       textBox.Text = msg.ToString();
      }
       
      catch (Exception exception)
      {
          textBox.Text = exception.Message;
    
          if (exception.InnerException != null)
          {
              textBox.Text += Environment.NewLine + @&quot;  -&gt;&quot; + exception.InnerException.Message;
          }
       }



TLS 1.2 not negotiated in .NET 4.7 without explicit ServicePointManager.SecurityProtocol call

Now that SSL 3 has been found to be vulnerable to the [POODLE][1] attack:  

Which versions of SSL/TLS does System.Net.WebRequest use when connecting to any https Uri?

I use WebRequest to connect to several 3rd party API&#39;s.  One of these has now said they will block any request that uses SSL 3.  But WebRequest is part of the .Net core framework (using 4.5) so it is not obvious what version it uses.


  [1]: http://arstechnica.com/security/2014/10/ssl-broken-again-in-poodle-attack/

Content Type	Original Author	Original Content on Stackoverflow
Question	TorbenJ	View Question on Stackoverflow
Solution 1 - C#	Ichabod Clay	View Answer on Stackoverflow

HttpWebRequest: Add Cookie to CookieContainer -> ArgumentException (Parametername: cookie.Domain)

C# Problem Overview

C# Solutions

Solution 1 - C#

Android cannot pass intent extras though AlarmManager

How to get a YouTube thumbnail from a YouTube iframe?

Attributions