the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 719
API
Cookies
Files
InputStream
BinaryRead
HttpMethod
Browser
UserAgent
AcceptTypes
UserLanguages
DESCRIPTION
Returns a collection of Cookie objects, which contain
details of the cookies received in the request, including
their names and values.
Returns a collection of files uploaded by the user.
Return different representations of the raw request
received from the client and therefore can be used
to access any of the information obtained by all the
other APIs.
Returns the method used in the HTTP request.
Return details of the user’s browser, as submitted in
the HTTP User-Agent header.
Returns a string array of client-supported MIME types,
as submitted in the HTTP Accept header.
Returns a string array containing the languages
accepted by the client, as submitted in the HTTP
Accept-Language header.
Session Interaction
ASP.NET applications can interact with the user’s session to store and retrieve
information in various ways.
The Session property provides a simple way to store and retrieve information
within the current session. It is accessed in the same way as any other indexed
collection:
Session[“MyName”] = txtMyName.Text;
// store user’s name
lblWelcome.Text = “Welcome “+Session[“MyName”]; // retrieve user’s name
ASP.NET profiles work much like the Session property does, except that they
are tied to the user’s profile and therefore actually persist across different sessions
belonging to the same user. Users are reidentified across sessions either
through authentication or via a unique persistent cookie. Data is stored and
retrieved in the user profile as follows:
Profile.MyName = txtMyName.Text;
// store user’s name
lblWelcome.Text = “Welcome “ + Profile.MyName; // retrieve user’s name
The System.Web.SessionState.HttpSessionState class provides another
way to store and retrieve information within the session. It stores information