How to use hwcrypto.js check persons use usb-token











up vote
1
down vote

favorite












I am currently developing a web based signing system use hwcrypto
When user plug usb-token device to computer then click button, it prompt select certificate and enter password:



window.hwcrypto.getCertificate({lang: lang, filter: filter})

.then(function(cert) {

    window.hwcrypto.sign(cert, {type: hashtype, hex: hash}, {lang: lang})

    .then(function(signature){

        // call jquery ajax to do some important thing

        $.ajax({

            url: 'index.php?action=very_important_action',

            dataType: 'html',

            success: function(response) {

                console.log(response);

        });

    });

});


It works, but i worry users call ajax function directly not use usb-token. How can I protect that?






javascript







share|improve this question


























    up vote
    1
    down vote

    favorite












    I am currently developing a web based signing system use hwcrypto
    When user plug usb-token device to computer then click button, it prompt select certificate and enter password:



    window.hwcrypto.getCertificate({lang: lang, filter: filter})
    
.then(function(cert) {
    
    window.hwcrypto.sign(cert, {type: hashtype, hex: hash}, {lang: lang})
    
    .then(function(signature){
    
        // call jquery ajax to do some important thing
    
        $.ajax({
    
            url: 'index.php?action=very_important_action',
    
            dataType: 'html',
    
            success: function(response) {
    
                console.log(response);
    
        });
    
    });
    
});


    It works, but i worry users call ajax function directly not use usb-token. How can I protect that?






    javascript







    share|improve this question
























      up vote
      1
      down vote

      favorite









      up vote
      1
      down vote

      favorite











      I am currently developing a web based signing system use hwcrypto
      When user plug usb-token device to computer then click button, it prompt select certificate and enter password:



      window.hwcrypto.getCertificate({lang: lang, filter: filter})
      
.then(function(cert) {
      
    window.hwcrypto.sign(cert, {type: hashtype, hex: hash}, {lang: lang})
      
    .then(function(signature){
      
        // call jquery ajax to do some important thing
      
        $.ajax({
      
            url: 'index.php?action=very_important_action',
      
            dataType: 'html',
      
            success: function(response) {
      
                console.log(response);
      
        });
      
    });
      
});


      It works, but i worry users call ajax function directly not use usb-token. How can I protect that?






      javascript







      share|improve this question













      I am currently developing a web based signing system use hwcrypto
      When user plug usb-token device to computer then click button, it prompt select certificate and enter password:



      window.hwcrypto.getCertificate({lang: lang, filter: filter})
      
.then(function(cert) {
      
    window.hwcrypto.sign(cert, {type: hashtype, hex: hash}, {lang: lang})
      
    .then(function(signature){
      
        // call jquery ajax to do some important thing
      
        $.ajax({
      
            url: 'index.php?action=very_important_action',
      
            dataType: 'html',
      
            success: function(response) {
      
                console.log(response);
      
        });
      
    });
      
});


      It works, but i worry users call ajax function directly not use usb-token. How can I protect that?






      javascript




      javascript






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked yesterday









      Bùi văn Nguyện

      37717




      37717
























          1 Answer
          1






          active

          oldest

          votes

















          up vote
          1
          down vote













          I have a few approaches in mind, but it depends on your implementation -




          1. You can set the usb-token in your local storage, and the page that is being requested has the check that usb-token field should already be available in the local storage.

          2. You can check for every ajax request that is being made, by using $.ajax.beforeSend and check if you have usb-token available.

          3. You can send the token as a query parameter and check in the page that is being requested, that if the parameter containing the token exists or not.






          share|improve this answer





















            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














             

            draft saved


            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53372325%2fhow-to-use-hwcrypto-js-check-persons-use-usb-token%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            1
            down vote













            I have a few approaches in mind, but it depends on your implementation -




            1. You can set the usb-token in your local storage, and the page that is being requested has the check that usb-token field should already be available in the local storage.

            2. You can check for every ajax request that is being made, by using $.ajax.beforeSend and check if you have usb-token available.

            3. You can send the token as a query parameter and check in the page that is being requested, that if the parameter containing the token exists or not.






            share|improve this answer

























              up vote
              1
              down vote













              I have a few approaches in mind, but it depends on your implementation -




              1. You can set the usb-token in your local storage, and the page that is being requested has the check that usb-token field should already be available in the local storage.

              2. You can check for every ajax request that is being made, by using $.ajax.beforeSend and check if you have usb-token available.

              3. You can send the token as a query parameter and check in the page that is being requested, that if the parameter containing the token exists or not.






              share|improve this answer























                up vote
                1
                down vote










                up vote
                1
                down vote









                I have a few approaches in mind, but it depends on your implementation -




                1. You can set the usb-token in your local storage, and the page that is being requested has the check that usb-token field should already be available in the local storage.

                2. You can check for every ajax request that is being made, by using $.ajax.beforeSend and check if you have usb-token available.

                3. You can send the token as a query parameter and check in the page that is being requested, that if the parameter containing the token exists or not.






                share|improve this answer












                I have a few approaches in mind, but it depends on your implementation -




                1. You can set the usb-token in your local storage, and the page that is being requested has the check that usb-token field should already be available in the local storage.

                2. You can check for every ajax request that is being made, by using $.ajax.beforeSend and check if you have usb-token available.

                3. You can send the token as a query parameter and check in the page that is being requested, that if the parameter containing the token exists or not.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered yesterday









                Aseem Upadhyay

                1,056520




                1,056520






























                     

                    draft saved


                    draft discarded



















































                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53372325%2fhow-to-use-hwcrypto-js-check-persons-use-usb-token%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    'app-layout' is not a known element: how to share Component with different Modules

                    Image
                    0 My application was working fine until I decided to go with lazy loading: So, my shared component looks like this: import { Component, Renderer2 } from '@angular/core'; export interface FormModel { captcha?: string; } @Component({ selector: 'app-layout', templateUrl: './app-layout.component.html', styleUrls: ['./app-layout.css'] }) export class FullLayoutComponent { } app-layout.component.ts I am using this component in my Another component say school-home.component.html like this: <app-layout> </app-layout> and it was working fine until I created a Module school-home.module.ts like this: import { NgModule } from '@angular/core'; import { CommonModule } from '@angular/common'; import { SchoolhomeRoutingModule ...
                    Read more

                    android studio warns about leanback feature tag usage required on manifest while using Unity exported app?

                    Image
                    .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 This is a simple project showing cubes on Unity, exported to android project and imported on Android studio. On maifest file it showed following warning: Expecting <uses-feature android:name="android.software.leanback" android:required="false" /> tag I have no information about it. And also on default emptyview android project does not use/mention this feature. I know it is required by TV's and such but why its not added by default? Why is this? And Should I concern about it? android unity3d ...
                    Read more

                    WPF add header to Image with URL pettitions [duplicate]

                    Image
                    up vote 0 down vote favorite This question already has an answer here: Image source URI requiring authorization 3 answers Add header to all* HTTP requests on a machine 1 answer first of all sorry for my english. Recently I added some security in the backend of my project, and now I need to send a validation code(apiKey) inside the headers to retrieve the images. I have a problem with ALL images in my project that I had attached in my UI. For example, before I had: <Image Height="90" Source="{Binding Video.Thumbnail}"/> Now I need to change my code to create a CUSTOM petition add the apiKey in the header:...
                    Read more