<transcript><audio_140>such issues which I didn't talk about but they are in the slide a third and very important aspect which people sometimes forget is every JSP page must first authenticate users before doing anything it should make sure the session</transcript><transcript><audio_141>is active who is the user before proceeding now what I have seen is people will do this in 90 out of 100 JSP pages but in 10 out of 100 they will forget this chick and this is not</transcript><transcript><audio_142>detected during testing because nobody is trying to break the system and once it is live somebody will eventually figure out that this particular JSP page can be executed without any login check or you know you can do something which</transcript><transcript><audio_143>violates the security policies of the site so what is important is that every JSP or servlet regardless of how you code it every thing in there must take that the session is there you people</transcript><transcript><audio_144>have logged in and that this person who is currently logged in is authorized to use this particular page that is a minimum security that is required now people forget to do this so a policy which we</transcript><transcript><audio_145>use at iit-b for example is that all of these checks secession active is the person authorized to use this check these are all put in one JSP file which is included in every other JSP file in fact this file has some other stuff like</transcript><transcript><audio_146>headers information for display and so on so the moment you include this file you can be sure that if the person is not logged in so if the session is not active the page will not get executed if the person is not authorized to view</transcript> such issues which I didn't talk about but they are in the slide a third and very important aspect which people sometimes forget is every JSP page must first authenticate users before doing anything it should make sure the session is active who is the user before proceeding now what I have seen is people will do this in 90 out of 100 JSP pages but in 10 out of 100 they will forget this chick and this is not detected during testing because nobody is trying to break the system and once it is live somebody will eventually figure out that this particular JSP page can be executed without any login check or you know you can do something which violates the security policies of the site so what is important is that every JSP or servlet regardless of how you code it every thing in there must take that the session is there you people have logged in and that this person who is currently logged in is authorized to use this particular page that is a minimum security that is required now people forget to do this so a policy which we use at iit-b for example is that all of these checks secession active is the person authorized to use this check these are all put in one JSP file which is included in every other JSP file in fact this file has some other stuff like headers information for display and so on so the moment you include this file you can be sure that if the person is not logged in so if the session is not active the page will not get executed if the person is not authorized to view
{"source": "grass-yt-cc-by.0RitPJG0BgI|shard_10035_43|create_multimodal_data.extract_yt_and_generate_transcripts.56|shard_10035|create_multimodal_data.generate_captions.29|shard_10035|create_multimodal_data.generate_captions.42", "params": {"id": "0RitPJG0BgI", "channel_id": "UC3lp1Pk33sziERUwvmiNBqQ", "duration": 2528, "view_count": 249, "age_limit": 0, "chapters": [{"start_time": 0, "end_time": 35.0, "title": "<Untitled Chapter 1>"}, {"start_time": 35.0, "title": "Application Architectures", "end_time": 718.0}, {"start_time": 718.0, "title": "Object-Relational Mapping and Hibernate (Cont.) \u2022 The Hibernate object-relational mapping system is widely used public domain system, runs on a variety of database systems \u2022 supports a query language that can express complex queries", "end_time": 728.0}, {"start_time": 728.0, "title": "Web Services . Allow data on Web to be accessed using remote procedure call mechanism . Two approaches are widely used", "end_time": 2528}], "like_count": 4, "channel_follower_count": 34800, "license": "Creative Commons Attribution license (reuse allowed)", "uploader_id": "@StudioIITBombay", "yt_tar_file": "/leonardo_work/EUHPC_E03_068/audio/fixed_download/grass-yt-cc-by//shard_10035/0RitPJG0BgI.tar.gz"}}