URL Security

URL Security SearchSearch
Author Message
Maged Negm
New member
Username: Magednegm

Post Number: 1
Registered: 12-2003
Posted on Tuesday, December 02, 2003 - 03:20 pm:   

Dear Sir,
i have implemented successfully the solution
of wap MMs in sending polyphonic and MMS to
mobile phones, but actually i have a problem.

My customer who receive that URL can access my server more times and download the polyphonic more times using that URL.

i need a security solution that disable this URL after the first download
Yoram Givon
New member
Username: Yoram_gi

Post Number: 6
Registered: 11-2003
Posted on Tuesday, December 02, 2003 - 03:44 pm:   

HI,

I would suggest to add a GUID or any code you want as a parameter in the URL.
use this code to validate the message and inside the code you have make sure to check that the code is a valid one.

For example:
If you are using a servlet to implement your code - add to the URL ?code = are64537

I would use a hash mechanisem to produce the codes, it is very easy to do so in Java.
Maged Negm
New member
Username: Magednegm

Post Number: 2
Registered: 12-2003
Posted on Wednesday, December 03, 2003 - 07:56 am:   

Dear Sir,
i am undarstanding the idea but i donot know how to implemenet it under the nowsms engine. How can i know that the customer is now connecting to my Gateway and downloading now ..etc,

Please i need more clarification

Thanks
Yoram Givon
New member
Username: Yoram_gi

Post Number: 8
Registered: 11-2003
Posted on Wednesday, December 03, 2003 - 08:25 am:   

hi

two questions so we can better understand your problem:

1) How do you generatethe URL?
2) What method of NowSMS engine do you use to notify the user - SMS, MMS notification, WAP Push and so on.
Maged Negm
New member
Username: Magednegm

Post Number: 3
Registered: 12-2003
Posted on Wednesday, December 03, 2003 - 08:32 am:   

Dear Sir ,
I am using the technique of WAP Multimedia Message

Thanks
Yoram Givon
New member
Username: Yoram_gi

Post Number: 9
Registered: 11-2003
Posted on Wednesday, December 03, 2003 - 11:33 am:   

Hi

Can you be a bit more specific.

Are you using a POST to the NowSMS GW?
Are you using the MMS notification mechanisem?
Are you using an application you have writen to POST the WAP notification or are you using NowSMS web interface to do so?

Maged Negm
New member
Username: Magednegm

Post Number: 4
Registered: 12-2003
Posted on Wednesday, December 03, 2003 - 12:01 pm:   

Dear Sir ,
i am using the web interface of NowSMS
Yoram Givon
New member
Username: Yoram_gi

Post Number: 10
Registered: 11-2003
Posted on Thursday, December 04, 2003 - 11:30 am:   

I have to admit that I cant think of a way to include a specific tag into the URL that the NowSMS web interface creates.

The way I do it is with a java code that uses the NowSms diferent interfaces.

maybe someone else here has a suggestion?

Yoram
Bryce Norwood - NowSMS Support
Board Administrator
Username: Bryce

Post Number: 1313
Registered: 10-2002
Posted on Friday, December 05, 2003 - 10:00 pm:   

Hi Maged/Yoram,

Apologies for the delay in joining this thread.

We're in the process of adding a configuration parameter to help address this issue. It will expire one of these dynamically generated URLs after x minutes of the first download attempt, or y download attempts (where x and y are configurable settings).

We're planning on an update patch for Friday, December 12, and this is one of the issues that is planned to be addressed.

-bn
Bryce Norwood - NowSMS Support
Board Administrator
Username: Bryce

Post Number: 1324
Registered: 10-2002
Posted on Monday, December 08, 2003 - 06:07 pm:   

A follow-up.

The logic that has been implemented for the next update is slightly different from what I described above. Here is a description from the upcoming readme for the update:


quote:

MMS/Multimedia WAP Push: Add configuration parameter to delete dynamically generated links (such as those used when sending MMS or Multimedia WAP Push) after they are accessed. To enable this feature, edit MMSC.INI, and under the [MMSC] section header, add ExpireDynamicLinks=##, where ## is the number of minutes after the link is first accessed before it should be automatically deleted.