Asp Forum - forms security - microsoft.public.frontpage.programming

Pat

4/12/2004 4:25:00 PM

What is the best way to ensure security with FP online forms?
How should permissions be set on the html file for the
online form and also on the files the forms write to?

Thanks
Pat

6 Answers

Greg Chagnon

4/12/2004 4:49:00 PM

Hi Pat,

Define the security that you're looking for?

Forms normally do not have any security as you want all visitors to complete them. Where the data of the forms is persisted is
normally protected with file permissions and with the best being when the files exist outside of the web tree.

--
Mike -- FrontPage MVP '97-'02
http://www.websunl...
Create fast, better scaling link bars with CSS Menu Maker
http://www.websunl.../order/Product/CssMenu/css_menu.htm
FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible

"Pat" <pwalch@blinn.edu> wrote in message news:1894001c420aa$b8411a60$a601280a@phx.gbl...
> What is the best way to ensure security with FP online forms?
> How should permissions be set on the html file for the
> online form and also on the files the forms write to?
>
> Thanks
> Pat
>

Pat

4/12/2004 5:08:00 PM

Right - I want everyone to be able to complete the forms
but the data file needs to be secure if it includes ID
numbers or financial info. How should permissions on that
file be set so the form can write to the file but only
selected users can access the data?

Thanks
Pat

>-----Original Message-----
>Hi Pat,
>
>Define the security that you're looking for?
>
>Forms normally do not have any security as you want all
visitors to complete them. Where the data of the forms is
persisted is
>normally protected with file permissions and with the best
being when the files exist outside of the web tree.
>
>
>--
>Mike -- FrontPage MVP '97-'02
>http://www.websunl...
>Create fast, better scaling link bars with CSS Menu Maker
>http://www.websunl.../order/Product/CssMenu/css_menu.htm
>FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
>
>
>"Pat" <pwalch@blinn.edu> wrote in message
news:1894001c420aa$b8411a60$a601280a@phx.gbl...
>> What is the best way to ensure security with FP online
forms?
>> How should permissions be set on the html file for the
>> online form and also on the files the forms write to?
>>
>> Thanks
>> Pat
>>
>
>
>.
>

Steve Easton

4/12/2004 5:24:00 PM

Have the form save the data to a file located in the _private folder.

--
Steve Easton
Microsoft MVP FrontPage
95isalive
This site is best viewed..................
...............................with a computer
"Pat" <pwalch@blinn.edu> wrote in message
news:16e4701c420b0$bc4b9760$a001280a@phx.gbl...
> Right - I want everyone to be able to complete the forms
> but the data file needs to be secure if it includes ID
> numbers or financial info. How should permissions on that
> file be set so the form can write to the file but only
> selected users can access the data?
>
> Thanks
> Pat
>
> >-----Original Message-----
> >Hi Pat,
> >
> >Define the security that you're looking for?
> >
> >Forms normally do not have any security as you want all
> visitors to complete them. Where the data of the forms is
> persisted is
> >normally protected with file permissions and with the best
> being when the files exist outside of the web tree.
> >
> >
> >--
> >Mike -- FrontPage MVP '97-'02
> >http://www.websunl...
> >Create fast, better scaling link bars with CSS Menu Maker
> >http://www.websunl.../order/Product/CssMenu/css_menu.htm
> >FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
> >
> >
> >"Pat" <pwalch@blinn.edu> wrote in message
> news:1894001c420aa$b8411a60$a601280a@phx.gbl...
> >> What is the best way to ensure security with FP online
> forms?
> >> How should permissions be set on the html file for the
> >> online form and also on the files the forms write to?
> >>
> >> Thanks
> >> Pat
> >>
> >
> >
> >.
> >

Eoin Miller

4/12/2004 5:41:00 PM

Well, Pat, you've got more problems than you were aware of. The problem is
not only whether users can see the data in the file you are writing it to;
it's a matter of reading the data as it is passed from the browser to the
server. This can be done using a piece of software called a "packet
sniffer" - it intercepts TCP/IP packets enroute. This is why there is SSL
(Secure Sockets Layer). SSL encrypts data going to and from the browser. You
should ask your hosting company if your web site can support SSL, and
whether or not they can supply you with a Secure Certificate.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.

"Pat" <pwalch@blinn.edu> wrote in message
news:16e4701c420b0$bc4b9760$a001280a@phx.gbl...
> Right - I want everyone to be able to complete the forms
> but the data file needs to be secure if it includes ID
> numbers or financial info. How should permissions on that
> file be set so the form can write to the file but only
> selected users can access the data?
>
> Thanks
> Pat
>
> >-----Original Message-----
> >Hi Pat,
> >
> >Define the security that you're looking for?
> >
> >Forms normally do not have any security as you want all
> visitors to complete them. Where the data of the forms is
> persisted is
> >normally protected with file permissions and with the best
> being when the files exist outside of the web tree.
> >
> >
> >--
> >Mike -- FrontPage MVP '97-'02
> >http://www.websunl...
> >Create fast, better scaling link bars with CSS Menu Maker
> >http://www.websunl.../order/Product/CssMenu/css_menu.htm
> >FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
> >
> >
> >"Pat" <pwalch@blinn.edu> wrote in message
> news:1894001c420aa$b8411a60$a601280a@phx.gbl...
> >> What is the best way to ensure security with FP online
> forms?
> >> How should permissions be set on the html file for the
> >> online form and also on the files the forms write to?
> >>
> >> Thanks
> >> Pat
> >>
> >
> >
> >.
> >

Pat

4/12/2004 6:14:00 PM

Thanks Mike, Kevin, Steve

Maybe I'm worrying too much - we do have SSL on the server
and yes I'm saving the data in the _private folder. Is this
enough?

Pat

>-----Original Message-----
>Have the form save the data to a file located in the
_private folder.
>
>
>--
>Steve Easton
>Microsoft MVP FrontPage
>95isalive
>This site is best viewed..................
>...............................with a computer
>"Pat" <pwalch@blinn.edu> wrote in message
>news:16e4701c420b0$bc4b9760$a001280a@phx.gbl...
>> Right - I want everyone to be able to complete the forms
>> but the data file needs to be secure if it includes ID
>> numbers or financial info. How should permissions on that
>> file be set so the form can write to the file but only
>> selected users can access the data?
>>
>> Thanks
>> Pat
>>
>> >-----Original Message-----
>> >Hi Pat,
>> >
>> >Define the security that you're looking for?
>> >
>> >Forms normally do not have any security as you want all
>> visitors to complete them. Where the data of the forms is
>> persisted is
>> >normally protected with file permissions and with the best
>> being when the files exist outside of the web tree.
>> >
>> >
>> >--
>> >Mike -- FrontPage MVP '97-'02
>> >http://www.websunl...
>> >Create fast, better scaling link bars with CSS Menu Maker
>>
>http://www.websunl.../order/Product/CssMenu/css_menu.htm
>> >FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
>> >
>> >
>> >"Pat" <pwalch@blinn.edu> wrote in message
>> news:1894001c420aa$b8411a60$a601280a@phx.gbl...
>> >> What is the best way to ensure security with FP online
>> forms?
>> >> How should permissions be set on the html file for the
>> >> online form and also on the files the forms write to?
>> >>
>> >> Thanks
>> >> Pat
>> >>
>> >
>> >
>> >.
>> >
>
>
>.
>

Greg Chagnon

4/12/2004 7:56:00 PM

I've seen a lot of WPP that have the _private unprotected. Do a test to make sure you can not retrieve the file.

--
Mike -- FrontPage MVP '97 - '02
http://www.websunl...

"Steve Easton" <admin@95isalive.com> wrote in message news:uF8nUNLIEHA.3988@tk2msftngp13.phx.gbl...
> Have the form save the data to a file located in the _private folder.
>
>
> --
> Steve Easton
> Microsoft MVP FrontPage
> 95isalive
> This site is best viewed..................
> ..............................with a computer
> "Pat" <pwalch@blinn.edu> wrote in message
> news:16e4701c420b0$bc4b9760$a001280a@phx.gbl...
> > Right - I want everyone to be able to complete the forms
> > but the data file needs to be secure if it includes ID
> > numbers or financial info. How should permissions on that
> > file be set so the form can write to the file but only
> > selected users can access the data?
> >
> > Thanks
> > Pat
> >
> > >-----Original Message-----
> > >Hi Pat,
> > >
> > >Define the security that you're looking for?
> > >
> > >Forms normally do not have any security as you want all
> > visitors to complete them. Where the data of the forms is
> > persisted is
> > >normally protected with file permissions and with the best
> > being when the files exist outside of the web tree.
> > >
> > >
> > >--
> > >Mike -- FrontPage MVP '97-'02
> > >http://www.websunl...
> > >Create fast, better scaling link bars with CSS Menu Maker
> > >http://www.websunl.../order/Product/CssMenu/css_menu.htm
> > >FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
> > >
> > >
> > >"Pat" <pwalch@blinn.edu> wrote in message
> > news:1894001c420aa$b8411a60$a601280a@phx.gbl...
> > >> What is the best way to ensure security with FP online
> > forms?
> > >> How should permissions be set on the html file for the
> > >> online form and also on the files the forms write to?
> > >>
> > >> Thanks
> > >> Pat
> > >>
> > >
> > >
> > >.
> > >
>
>

microsoft.public.frontpage.programming

forms security

Pat

Greg Chagnon

Pat

Steve Easton

Eoin Miller

Pat

Greg Chagnon

x Login to ForumsZone