Client-Server Proxy

Client-Server Proxy
Client-server proxy is sometimes also known as client/SOA. Client-server proxy
applications have two main determining factors: they rarely require a full page reload
during usage, and session state is mostly handled by the client. Due to the lack of full
page reloads, the client-server proxy style of AJAX applications is often described as
“wrapping an AJAX GUI around a web service.”
In the proxy style of AJAX application, the JavaScript that will be executed in a client’s web browser can be generated in two ways. The first way is for the JavaScript
methods to be prerendered on the server and then sent down to the client. These methods are generally named the same or quite similar to methods on the server. When the
client receives the JavaScript methods from the server, the methods are simply plugged
into an eval()and executed. The other style generating the JavaScript is for the server
to send down a chunk of JavaScript to the client, which, once executed, is able to generate new JavaScript methods on the fly. This JavaScript generates methods on the fly by
reading a list of methods defined by the server in a file such as a Web Services Description Language (WSDL) file. In practice, the prerendered style of generating JavaScript is
more commonly seen in real-world AJAX applications, while on-the-fly generation is
usually seen only with web applications that use Simple Object Access Protocol
(SOAP).
Despite the number of different client-server proxy frameworks in existence, the steps
involved with creating a proxy style AJAX web application are generally the same:
1. The framework looks at server-side code, such as a Java web application, where
certain methods are tagged as public.
2. The framework is told which of these functions are to be exposed to clients. 3. Framework code then automatically goes through and tags these methods and
generates a JavaScript proxy that puts methods, often of the same name, into
the web browser.
4. Then, whenever the client makes a method call in JavaScript, the call is passed
on to the JavaScript proxy and then on to the actual method being called.
This allows for easy abstraction, for example, if one development team is working on
the actual application and another team is working on web design. The web design team
can simply be handed a file of JavaScript methods that can be called to perform work
when needed, without having to interact with the behind-the-scenes Java application. A
client-server proxy style application such as this requires the client to contain all of the
available methods, because, due to the asynchronous nature of AJAX, any method can be
called at any time. For this reason, a client-server proxy style AJAX implementation is
quite interesting and useful from an attacker’s perspective.

How was the Millennium Eye built ? London Eye History

The Millennium Eye, or London Eye, is unique among observation Ferris wheels. All of the wheel’s main components were built separately off-site and came from six different countries. They were then floated on barges up the River Thames to the Eye’s South Bank location, which presented some challenges – once loaded onto trailers each capsule measured 4.9 metres (16 feet) tall, requiring careful route planning on their journey to avoid low bridges. The Eye was assembled horizontally on platforms in the river next to the site, with a massive floating crane lifting the rim sections into place. Once the wheel was assembled, the Eye was raised upright using hydraulic strand jacks. There was a hiccup as a temporary cable snapped, but over the course of a week the Eye was raised in stages and secured, before the capsules were attached to the rim.

Were Spartans really obsessed with fighting?

Spartan culture was largely centred on the development of their military, but they were also a deeply religious and cultural people who enjoyed music, dance, poetry, art and sporting events. The city of Sparta housed prominent buildings, temples and a theatre. Spartan bronze products were of an extremely high quality and were viewed as valuable diplomatic gifts. Spartan society gave women economical power and influence and girls received a public education and engaged in sports – all things unheard of in neighbouring Greek societies in 600 BCE. Historians know of four Spartan poets whose works were praised by critics throughout the world and the Spartans were known to regularly hold popular music and dance festivals. It is impossible not to recognise the exceptional nature of Spartan military achievements, which is largely why other aspects of Spartan culture get overlooked.
However after two costly wars in the late-eighth and early-seventh century BCE, the Spartans increasingly sought diplomatic means to solve conflicts.

What Makes a Web Application Vulnerable?

Your application is vulnerable to CSRF (Cross-Site Request Forgery (CSRF or XSRF), an URL Command Attack, or Session Riding) if you answer yes to all of the following questions:
• Does your application have a predictable control structure? It is extremely rare that a web application will use a URL structure that is not highly predictable across users. This is not a flaw by itself; there is little valid engineering benefit to using overly complex or randomized URLs for user interaction.
• Does your application use cookies or integrated browser authentication?
The accepted best practice for web application developers has been to utilize properly scoped, unguessable cookies to authenticate that each request has come from a valid user. This is still a smart practice, but the fact that browsers automatically attach cookies in their cache to almost any cross-domain request enables CSRF attacks unless another authentication mechanism is used. Browser authentication mechanisms such as HTTP Auth, integrated Windows Authentication, and Client Certificate authentication are automatically employed on cross-domain requests as well, providing no protection against CSRF. Long session timeouts are also an issue that expose applications to CSRF, as a user can login in once and stay logged in for many days/weeks (allowing CSRF attacks to target application that allow long session timeouts).

Preventing Cross Site Scripting,

To prevent XSS, developers must be very careful of user-supplied data that is served back to users. We define user-supplied data as any data that comes from an outside network connection to some web application. It could be a username submitted in an HTML form at login, a backend AJAX request that was supposed to come from the JavaScript code the developer programmed, an e-mail, or even HTTP headers. Treat all data entering a web application from an outside network connection as potentially harmful.
For all user-supplied data that is later redisplayed back to users in all HTTP responses such as web pages and AJAX responses (HTTP response code 200), page not found errors (HTTP response code 404), server errors (like HTTP response code 502), redirects (like HTTP response code 302), and so on, the developer must do one of the following:
•Escape the data properly so it is not interpreted as HTML (to browsers) or XML (to Flash).
•Remove characters or strings that can be used maliciously. Removing characters generally affects user experience. For instance, if the developer removed apostrophes (’), some people with the last name O’Reilly, or the like, would be frustrated that their last name is not displayed properly.
We highly discourage developers to remove strings, because strings can be represented in many ways. The strings are also interpreted differently by applications and browsers. For example, the SAMY worm took advantage of the fact that IE does not consider new lines as word delimiters. Thus, IE interprets JavaScript and jav%0dascr%0dipt as the same. Unfortunately, Myspace interpreted new lines as delimiting words and allowed the following to be placed on Samy’s (and others’) Myspace pages:

We recommend escaping all user-supplied data that is sent back to a web browser within AJAX calls, mobile applications, web pages, redirects, and so on. However, escaping strings is not simple; you must escape with URL encoding, HTML entity encoding, or JavaScript encoding depending on where the user-supplied data is placed in the HTTP responses.

What is gas?

This classic state of matter can be difficult to see but it has some amazing properties.A long with liquids and solids, gases are one of the three major states of matter. Typically they result when a substance is heated in its liquid state to its boiling point, or when evaporation occurs from the surface of a liquid. There are numerous types and classifications of gases, including elements that naturally exist in a gaseous form, compound gases comprising more than one element, and mixtures of individual pure gases. Gas particles are much more loosely connected than those found in liquid or solid states, which results in lower density – and this is ultimately what sets a gas apart from the other two phases. Without changes in pressure or temperature, gas particles move around freely and randomly. They have no set shape and only change direction and momentum when bouncing off one another or off the inside of a container. Negatively charged areas of particles are attracted to positively charged areas – how these interact varies depending on the gas and are part of what makes each one unique. Because most gases are colourless, they are measured by four different : volume, temperature, pressure and number of particles; the latter property is more commonly known as moles. When put into a container (and not pressurised) gas molecules will evenly distribute themselves.

How do Barcodes work? How machine reads barcode ?

Barcodes are a machine-readable way of writing letters and numbers. A laser is shone onto the barcode and the reflected light can be interpreted by the barcode reader. There are many types of barcodes, but the ones most commonly found in supermarkets use a row of lines of different widths. The different widths represent different numbers. In the UK many items are coded with a GTIN – Global Trade Item Number. This allows the manufacturer to print the barcode on the packages. The numbers are unique to that item. The barcode only has a number, but no product information. That is held in a database which the retailer can access at the point of sale. It also means that shops can set their own prices and change them easily.