+
diff --git a/Myrtille.Web/Default.aspx.cs b/Myrtille.Web/Default.aspx.cs
index fdbcb8f..87fa5a8 100644
--- a/Myrtille.Web/Default.aspx.cs
+++ b/Myrtille.Web/Default.aspx.cs
@@ -18,22 +18,44 @@ limitations under the License.
using System;
using System.Collections.Generic;
+using System.Configuration;
using System.IO;
using System.Text;
using System.Text.RegularExpressions;
+using System.Threading;
using System.Web;
using System.Web.SessionState;
using System.Web.UI;
+using System.Web.UI.HtmlControls;
+using System.Web.UI.WebControls;
using Myrtille.Helpers;
+using Myrtille.Services.Contracts;
namespace Myrtille.Web
{
public partial class Default : Page
{
+ private MFAAuthenticationClient _mfaAuthClient;
+ private EnterpriseServiceClient _enterpriseClient;
+
+ private EnterpriseSession _enterpriseSession;
protected RemoteSession RemoteSession;
///
+ protected void Page_Init(
+ object sender,
+ EventArgs e)
+ {
+ _mfaAuthClient = new MFAAuthenticationClient();
+ _enterpriseClient = new EnterpriseServiceClient();
+ }
+
+ ///
@@ -41,72 +63,121 @@ protected void Page_Load(
object sender,
EventArgs e)
{
- #region session fixation attack
+ // prevent session fixation or stealing
+ SessionFixationHandler();
- // prevent session fixation attack by generating a new session ID upon login
- // https://www.owasp.org/index.php/Session_Fixation
- if (!string.IsNullOrEmpty(HttpContext.Current.Request["oldSID"]))
+ // retrieve the active enterprise session, if any
+ if (HttpContext.Current.Session[HttpSessionStateVariables.EnterpriseSession.ToString()] != null)
{
try
{
- HttpContext.Current.Application.Lock();
-
- // retrieve the given (old) http session
- var httpSessions = (IDictionary