ASP.NET

Unable to read from web.config

5-Jan-21 0:04

Asanka Prabath wrote:
cm = New SqlCommand("select * from tblbill where SalesOrderNo like '" & txtInvoiceFor.Text & "'", cn)

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

You already know how to use parameters - you've done it on the following command.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex11-Dec-20 8:35

11-Dec-20 8:35

Sorry for another thread.

I have the following that is supposed to read from web.config file.

public string ReadConfig(string ValueToGet)
{
    System.Configuration.AppSettingsSection section = (System.Configuration.AppSettingsSection)config.GetSection("appSettings");
    return section.Settings[ValueToGet].Value;
}

// get the report URL
string URL = Master.ReadConfig("DailyReport");

The application runs perfectly on my local machine but again when run from the server, it gives the following error:

Object reference not set to an instance of an object.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.

Any idea how to fix this?

Thanks again in advance

Richard MacCutchan11-Dec-20 8:42

Richard MacCutchan

11-Dec-20 8:42

Which line of code raised the error? The actual problem is usually not to difficult to resolve once you know which reference is the problem. You may wish to edit your question and show the actual contents of the config file. Are you sure all refernces are correctlym spelled?

samflex11-Dec-20 10:02

11-Dec-20 10:02

Richard, thanks for your response.

This is the ReadConfig () method:

public string ReadConfig(string ValueToGet)
{
    System.Configuration.AppSettingsSection section = (System.Configuration.AppSettingsSection)config.GetSection("appSettings");
    return section.Settings[ValueToGet].Value;
}

The first error is on this line:

return section.Settings[ValueToGet].Value;

Then ReadConfig tries to call the report with this:

// get the report URL
string URL = Master.ReadConfig("DailyReport");

This is the line that generated the second error.

Then this is the web.config content that Master.ReadConfig("DailyReport"); is trying to call:

<add key="DailyReport" value="http://servername/ReportServer?/Reports/DailyReport"/>

I have had similar issues with ReadConfig() function which I was able to resolve.

For instance, This line was generating exact same error:

appVersion.Text = ReadConfig("AppVersion");

and I was able to resolve it with this:

WebConfigurationManager.AppSettings["AppVersion"]

But the Master.ReadConfig(...) line is a bit too challenging.

Richard MacCutchan11-Dec-20 23:20

Richard MacCutchan

11-Dec-20 23:20

There is a sample that shows how to do it at AppSettingsSection Class (System.Configuration) | Microsoft Docs[^].

samflex12-Dec-20 5:16

Server not recognizing AD info (SOLVED)

12-Dec-20 5:16

It's ok.

I have resolved the problem.

samflex10-Dec-20 11:42

10-Dec-20 11:42

Greetings experts,

I have been struggling with this now for about two days to no avail.

When a user loads our app on a browser, the app determines user's machine name and determines whether user should have a Read Only access to the app or Read/Write access based on two AD group names.

If the user does not belong to any of those groups, access to the app is denied the user with a message indicating so.

This works perfectly on my local machine.

However, when I deploy the app to our server, it does not record user's access level and is constantly denying user access to the app.

We have determined that the server can communicate with our AD.

I am pretty stumped by this.

Can someone please help with the code below and see if it could be written differently?

Many thanks in advance.

IPAddress hostIPAddress = IPAddress.Parse(Request.UserHostName);
IPHostEntry hostInfo = Dns.GetHostEntry(hostIPAddress);
string[] tempSystemName = hostInfo.HostName.Split('.');

WebLibrary.loadUserInformation(Request.LogonUserIdentity.Name, Request.UserHostAddress, tempSystemName[0]);
currentUser.Text = "Current User: " + WebLibrary.visitorFullName + "<br />Access: " + userType + "";

modified 11-Dec-20 13:12pm.

Richard Deeming11-Dec-20 1:25

11-Dec-20 1:25

Is the user actually authenticating to your application? You need to make sure anonymous authentication is turned off, and Kerberos/Windows authentication is turned on.

Depending on your group policy settings, Internet Explorer, Edge, and Chrome should automatically sign the user in to any site which is part of IE's "local intranet" zone. Firefox will need additional configuration in the about:config page:

network.automatic-ntlm-auth.allow-proxies = True
network.negotiate-auth.allow-proxies = True
network.automatic-ntlm-auth.trusted-uris = comma-separated list of host names which should use integrated authentication

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex11-Dec-20 4:20

11-Dec-20 4:20

Hi Richard,

Great to hear from you sir.

Hope you are staying safe.

I just turned off Anonymous Authentication and enabled Windows Authentication and now it works.

The only issue (a minor one) is that unlike running on my local machine where the application automatically authenticates my account and allows me in, the application is asking me to sign in using my Windows account.

Once this is done, I am automatically in and it works now.

When this app runs on our production server, users are not explicitly asked to sign in. Their identities are automatically recognized and they are in without having to sing in.

Oh well, this is our test site. I guess we have to deal with having to sign in all the time.

UPDATE: I set .Net Rules in IIS as well to deny anonymous users and now it is no longer challenging for authentication.

Many thanks. You have never failed me. Thank you sir.

modified 11-Dec-20 9:31am.

Richard Deeming11-Dec-20 4:29

11-Dec-20 4:29

Sounds like your test site isn't being picked up as part of the "local intranet" zone.

Configure Chrome and Microsoft Internet Explore... | RSA Link[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

samflex11-Dec-20 8:12

SSL Certificate problem with Local IIS, ADFS and Visual Studio

11-Dec-20 8:12

Sorry sir, I forgot to close this out.

Thank you again for your continued assistance.

Super Lloyd9-Dec-20 16:54

Super Lloyd

9-Dec-20 16:54

In our web solution we have a WebAPI solution, a WebApplication and a local ADFS server.
ADFS server need be setup with exact URL of web app....

For simplicity sake we decided to use (local) IIS hosting and debugging, as in "<a href="http://localhost/myAPI">http://localhost/myAPI</a>" and "https://localhost/myWebApp"

The problem starts when.. and HTTPS app need a certificate...
So I got to:
IIS Management Studio > Default Web Site > Bindings...

And add the ISS Express Development Certificate.

Unfortunately, it feels like Visual Studio is deleting that setting every second time I press F5 / try to debug. And I continuously have to open IIS Management Console and setup the HTTPS binding again and again and again.

Any idea what's going on and fix that bummer?

A new .NET Serializer
All in one Menu-Ribbon Bar
Taking over the world since 1371!

pass the id to the modal

Member 149089649-Nov-20 9:42

Member 14908964

9-Nov-20 9:42

@{
              foreach (var item in (List<TarefasModel>)ViewBag.MostrarTarefas)
              {
                      <tr>
                          <td><button type="button" class="btn btn-warning" data-toggle="modal" data-target="'#Modalpopup + @item.Id'">Editar</button></td>
                          <td>@item.Id</td>
                          <td>@item.NomeTarefa</td>
                          <td>@item.Descricao</td>
                          <td>@item.Atribuido</td>
                          <td>@item.DataVencimento</td>
                          <td><button type="button" class="btn btn-success" onclick="Excluir(@item.Id)">Concluido</button></td>
                      </tr>

              }
          }

      </tbody>

I need pass the ID in modal . I try this :

<td><button type="button" class="btn btn-warning" data-toggle="modal" data-target="'#Modalpopup + @item.Id'">Editar</button></td>

But this not work

Re: pass the id to the modal

Richard Deeming9-Nov-20 23:02

ASP.NET Code with Azure AD Authentication Not working in Chrome and Edge

9-Nov-20 23:02

How about you start with the documentation?
Modal · Bootstrap v4.5 - Varying modal content[^]

If that doesn't help, you're going to need to explain what "not working" means, and show the markup and script for your modals.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Member 111541884-Nov-20 5:51

Member 11154188

4-Nov-20 5:51

Hi Friends,

we are integration our application with Azure AD.
After integration application is not working in Chrome and Edge browser, but works in IE.
In Chrome and Edge its navigating to login and after successful login getting redited to Internet Information Services (Windows Server) Page.

During debug, found below line gives Object Reference error in Edge and Chrome browser, whereas giving value in IE.

System.Security.Claims.ClaimsPrincipal.Current.FindFirst("preferred_username").Value

Thanks In Advance,

Re: ASP.NET Code with Azure AD Authentication Not working in Chrome and Edge

Richard MacCutchan4-Nov-20 22:46

Richard MacCutchan

4-Nov-20 22:46

See ClaimTypes Class (System.Security.Claims) | Microsoft Docs[^]

Member 1497830828-Oct-20 23:13

Member 14978308

28-Oct-20 23:13

I designed a login page but currently i created users on SQL server that I use as users on the login page.

I will like users to login using their windows authentication.

Re: Login using windows authentication using asp.net C#

Richard Deeming28-Oct-20 23:57