INSTALLATION AND CONFIGURATION MANUAL ENCODER

Transcription

1 INSTALLATION AND CONFIGURATION MANUAL ENCODER P R O F E S S I O N A L S O F T W A R E E N G I N E E R I N G Meridium AB 1 (19) 1(19)

2 CONTENTS 1 INTRODUCTION How does it work? Browser software supported Server software supported Web Accessibility Initiative (WAI) support INSTALLATION Installation Step 1 Choose web server Installation Step 2 Choose license file Installation Step 3 - Finish CONFIGURATION ConfigSections Http Modules Http Handlers EncoderModule section Activate loose mailto filtering Activate loose callto filtering Activate strip not filtered mailto Activate strip not filtered callto Disable paths (start) for Encoder Disable files/types for Encoder Disable sessions for Encoder Disable query string parameters for Encoder Set alt text on mailto text-images Set alt text on callto text-images Force Content Encoding encoding modes Activate encoding on cached pages Add title to mailto links Disable encoding for authenticated users Control css style of generated image tags Control css class of generated image tags Log file Continue on error Embedded Handler section Meridium AB 2 (19) 2(19)

3 3.5.1 Set font for mailto text-images Set text color for mailto text-images Set background color for mailto text-images Set mailto text-images cache EPISERVER CONFIGURATION Activate strip not filtered mailto Disable paths for Encoder Disable encoding for authenticated users UNINSTALLATION Disabling Encoder Full uninstallation Remove configuration entries in the web.config file Remove installed files Meridium AB 3 (19) 3(19)

4 1 INTRODUCTION Encoder protects addresses and Skype 1 links from being picked up by robots/sniffers by converting them to images with encrypted links. Encoder can be applied to any ASP.NET solution without modifications, and works as a filter towards the web client. 1.1 How does it work? Encoder is added as a HTTP module on the dot net web server and scans all ASP.NET pages that are delivered to the clients. When an , mailto or callto 2 -link is found, this is encoded and is not readable by normal means to the reader of the page. When the browser then loads the page, the information is decoded in runtime in the browser and made visible to the reader. This restricts reading the source of the page for retrieving or Skype information since the and Skype addresses are not visible in clear text. 1.2 Browser software supported Encoder can be used on all Web browsers supporting JavaScript (according to the ECMA 262 specification 3 ) and W3C DOM specification 4 (Core version 2.0 and Events version ). Encoder also supports the major browser versions including (but not limited to): Browser Reference Microsoft Internet Explorer 5 or later Mozilla Firefox 1.0 or later Mozilla Firebird 0.7 or later Mozilla (1.7.3 verified) Opera (7.23 verified) Netscape 6.01 or later Server software supported The Encoder is installed on a website running asp.net on a machine running Internet Information Services (IIS). It can be run under version 1.0, 1.1 and 2.0 of the dotnet framework. 1.4 Web Accessibility Initiative (WAI) 6 support Since version , Encoder does not alter the encoded pages support for WAI in any way. If you choose to increase security by using generated images replacing the visible s, you will hamper WAI support a bit, since no information besides the static alt text is added to the images. 1 Skype is software for IP-telephony. See for more information. 2 Callto links are used by Skype Meridium AB 4 (19) 4(19)

5 2 INSTALLATION Encoder is installed by running the installation application. The installation application copies the needed files, and makes the necessary modifications of the system configuration. The system configuration is modified by adding some keys to the web.config. Some of these keys are configurable as explained below. 2.1 Installation Step 1 Choose web server The installation application lets you choose the web server you wish to install Encoder on by showing a drop down list with all web servers available on the computer. Meridium AB 5 (19) 5(19)

6 2.2 Installation Step 2 Choose license file Browse to the license file that you received with the installation package and choose it. The license file is named meridiumlicense.config. 2.3 Installation Step 3 - Finish Click on Finish to complete the installation. Meridium AB 6 (19) 6(19)

7 3 CONFIGURATION The installation program adds the following keys to web.config. 3.1 ConfigSections The ConfigSections need to contain two configuration sections for the Encoder to work; one for the EncoderModule and one for the EmbeddedHandler. <configsections> <sectiongroup name="se.meridiumkalmar.web"> <section name="embeddedhandler" type="system.configuration.namevaluesectionhandler, System, = , Culture=neutral,PublicKeyToken=b77a5c561934e089"/> <section name=" encodermodule" type="system.configuration.namevaluesectionhandler, System, = , Culture=neutral,PublicKeyToken=b77a5c561934e089"/> </sectiongroup> </configsections> 3.2 Http Modules This activates the Encoder module. If you want to deactivate Encoder, just comment this add tag. <httpmodules> <add name=" encodermodule" type="se.meridiumkalmar.web. encodermodule, Encoder.Core" /> </httpmodules> 3.3 Http Handlers This activates the EmbeddedHandler. Without this Encoder cannot deliver any images for addresses. <httphandlers> <add verb="*" path="embed.aspx" type="se.meridiumkalmar.web.embeddedhandler, Encoder.Core" /> </httphandlers> Meridium AB 7 (19) 7(19)

8 3.4 EncoderModule section The Encoder section contains all configuration settings for the encoding process, what to encode and how to do it. <se.meridiumkalmar.web> < encodermodule> <! -insert configuration items here--> </ encodermodule> </se.meridiumkalmar.web> Activate loose mailto filtering If activated, Encoder will filter mailto links inside page links. If value is set to true, the following text will be filtered. <add key="loos tohref" value="true"/> Activate loose callto filtering If activated, Encoder will filter callto links inside page links. If value is set to true, the following text will be filtered. href="mylink.aspx?action=callto://nisse_mklsd_as/" <add key="loosecalltohref" value="true"/> Activate strip not filtered mailto If activated Encoder will strip texts that contains a mailto address but not are links. If value is set to true <a href=" orgurl="mailto:info@meridium.se"/> Will be filtered to <a href=" orgurl=""/> <add key="stripnotfilteredmailto" value="true"/> Meridium AB 8 (19) 8(19)

9 3.4.4 Activate strip not filtered callto If activated Encoder will strip texts that contains a mailto address but not are links. If value is set to true <a href=" callid="callto://meridium/"/> Will be filtered to <a href=" callid=""/> <add key="stripnotfilteredcallto" value="true"/> Disable paths (start) for Encoder To disable the encoding for one or more virtual paths set value to the paths that you want to disable Encoder for, separated by & Always start and end the path with a slash if it is a folder. Always start the path with a slash if it is a complete path to a document. Values are case insensitive. <add key="disablevirtualpathstartingwith" value="/edit/"/> Disables Encoder for all Requests to a path that starts with /edit/. <add key="disablevirtualpathstartingwith" value="/edit/&/admin/default.aspx"/> Disables Encoder for all requests to a path that starts with /edit/ and requests for the file /admin/default.aspx. <add key="disablevirtualpathstartingwith" value=""/> Meridium AB 9 (19) 9(19)

10 3.4.6 Disable files/types for Encoder To disable the encoding for one or more files or file types the requested path is scanned and compared to the DisableVirtualPathEndingWith parameter. This parameter works like the DisableVirtualPathStartingWith and you can separate multiple values with an virtual paths set value to the paths that you want to disable Encoder for, separated by & Values are case insensitive. <add key="disablevirtualpathendingwith" value=".asmx"/> Disables Encoder for all web services. <add key="disablevirtualpathendingwith" value="news.aspx&.asmx "/> Disables Encoder for all requests to files named news.aspx wherever they are located and all web services. <add key="disablevirtualpathendingwith" value=".asmx "/> Disable sessions for Encoder To disable the encoding for one or more session keys and/or key-value pairs set value to the session keys and - if needed - their corresponding value that Encoder should be disabled for, separated by & <add key="disablesession" value="user"/> Disables Encoder for all Requests that have a session key named user. <add key="disablesession" value="user=peter&user=tom"/> Disables Encoder for all Requests that have a session key named user with value peter or tom. <add key="disablesession" value=""/> Meridium AB 1010(19)

11 3.4.8 Disable query string parameters for Encoder To disable the encoding for one or more parameters and/or parameter-value pairs set value to the parameters and - if needed - their corresponding value that Encoder should be disabled, for separated by & <add key="disableparam" value="editmode"/> Disables Encoder for all requests that have a query string parameter named editmode. <add key="disableparam" value="editmode=true&user=peter"/> Disables Encoder for all Requests that have a query string parameter named editmode with value true or a query string parameter named user with value peter. <add key="disableparam" value=""/> Set alt text on mailto text-images The text specified as value will appear as alt-text on the mailto text-image. <add key="alttextonimages" value="this is a mailto link"/> Set alt text on callto text-images The text specified as value will appear as alt-text on the mailto text-image. <add key="alttextoncalltoimages" value="this is a callto link"/> Force Content Encoding The content encoding of the encoding output can be forced if the automatic parsing fails. <add key="contentencoding" value="iso "/> Meridium AB 1111(19)

12 encoding modes The way the addresses are encoded can be configured to the following values. Value Text Image TextAndImage None Description Encodes all visible addresses as text (requires JavaScript support on the client) Encodes all visible addresses as an image. Uses a combination of the above choices, when JavaScript is not supported by the client, the Address image is still visible Does not encode addresses at all (disables the Encoder) <add key=" encodermode" value="textandimage"/> Activate encoding on cached pages Normally encoding is done to pages before they are added to the cache, and encoding is not needed for cached pages. If you want to force encoding on cached pages, set the EncodeCache configuration to true. <add key="encodecache" value="true"/> Add title to mailto links To increase WAI support you can activate this option that will add a title attribute to a mailto link that will contain the linked mailto: @domain.com text. <add key="addtitleonmailtolinks" value="true"/> Meridium AB 1212(19)

13 Disable encoding for authenticated users Sometimes you want to disable encoding for authenticated users since you have already taken steps to validate the user. In that case you can add the following option to the configuration. Default is false. <add key="disableencodingforauthenticatedusers" value="true"/> Control css style of generated image tags When Encoder generates images for the visible addresses, the image is added without any attributes set to the image tag. Use the CssStyle property to set the style attribute for the rendered image tags. <add key="cssstyle" value="border:0;text-align:middle;"/> Control css class of generated image tags When Encoder generates images for the visible addresses, the image is added without any attributes set to the image tag. Use the CssClass property to set the class attribute for the rendered image tags. <add key="cssclass" value="myimageclass"/> Log file If an error occurs in the Encoder engine, you can activate logging by entering a path to a file where the errors will be logged. The path can either be relative from the websites root folder or if entered with the drive letter, an absolute path. <add key="logfile" value="errorlog.txt"/> Make sure that the server process has access rights to write to/create the file. Meridium AB 1313(19)

14 Continue on error If encoding of a page results in an error, this error is logged (if the log file is activated) and the error is displayed on the page. These error pages can be suppressed and instead of breaking the page, the original, non encoded page can be displayed. To activate this behavior set the ContinueOnError setting to true. Observe that if this option is activated, use the logfile to keep track of pages that are failing and fix these errors in these pages so they aren t unprotected. <add key="continueonerror" value="true"/> Meridium AB 1414(19)

15 3.5 Embedded Handler section The EmbeddedHandler is a part of encoder that controls the images that is generated instead of visible addresses. This section controls all settings regarding the image creation process. <se.meridiumkalmar.web> <embeddedhandler> <! -insert configuration items here--> </embeddedhandler> </se.meridiumkalmar.web> Set font for mailto text-images If the displayed text for a mailto link contains the Encoder replaces the text with a text-image. To specify the font to be used in these cases use the following format: font name, size, fontstyle1, fontstyle2, etc. Font styles can be bold, italic, underline or strikeout. Replaces the display text that for all mailto links with a text-image with font verdana 8pt bold italics. <add key="font" value="verdana, 8, bold, italics"/> Set text color for mailto text-images If the display text for a mailto link contains the Encoder replaces the text with a text-image. Set value to the text color that should be used in the text-image. <add key="foregroundcolor" value="#c0c0c0"/> Set background color for mailto text-images The resulting image of a mailto link is created as a transparent gif. If the background of the page is another color than white, the resulting image can look jaggy or even disappear (especially if the foreground color is set to white). The solution is then to assign a background color to use when rendering the images. <add key="backgroundcolor" value="white"/> Meridium AB 1515(19)

16 3.5.4 Set mailto text-images cache If a special temporary path should be used for storing the images cache. The ASPNET user s temp path is used by default. <add key="temppath" value="c:\temp"/> Meridium AB 1616(19)

17 4 EPISERVER CONFIGURATION Use the following settings for Encoder when running an EPiServer solution. (These settings are automatically configured if you use the installation package for EPiServer.) Activate strip not filtered mailto For EPiServer you want to set StripNotFilteredMailto to true in order to strip orgurl attributes on mailto links. <add key="stripnotfilteredmailto" value="true"/> Disable paths for Encoder For EPiServer you want to disable the admin, edit and util paths. <add key="disablevirtualpathstartingwith" value="/edit/&/admin/&/util/"/> Disable encoding for authenticated users For DOPE to function correctly with addresses, we have to disable encoding for authenticated users. <add key="disableencodingforauthenticatedusers" value="true"/> Meridium AB 1717(19)

18 5 UNINSTALLATION 5.1 Disabling Encoder 1. To disable Encoder, just comment the Encoder httpmodule in the web.config file located at /configuration/system.web/httpmodules <add name=" encodermodule" type="se.meridiumkalmar.web. encodermodule, Encoder.Core" /> 5.2 Full uninstallation Uninstallation can be performed manually by following the steps below Remove configuration entries in the web.config file. 2. Remove the Encoder http module located at /configuration/system.web/httpmodules <add name=" encodermodule" type="se.meridiumkalmar.web. encodermodule, Encoder.Core" /> 3. Remove the Encoder http handler located at /configuration/system.web/httphandlers <add verb="*" path="embed.aspx" type="se.meridiumkalmar.web.embeddedhandler, Encoder.Core" /> 4. Remove configuration for the encodermodule located at /configuration/se.meridiumkalmar.web/ encodermodule < encodermodule> <add key=" encodermode" value="textandimage" /> <add key="addtitleonmailtolinks" value="true" />... </ encodermodule> 5. Remove configuration for the embeddedhandler located at /configuration/se.meridiumkalmar.web/embeddedhandler <embeddedhandler> <add key="font" value="verdana,14, underline" /> <add key="foregroundcolor" value="#33ccaa" />... </embeddedhandler> 6. If the se.meridiumkalmar.web element is empty, remove it aswell. (located at /configuration/se.meridiumkalmar.web) <se.meridiumkalmar.web> </se.meridiumkalmar.web> 7. Remove the section groups for encodermodule located at /configuration/configsections/sectiongroup[name= se.meridiumkalmar.web ]/section [name= encodermodule ] <section name=" encodermodule" type="system.configuration.namevaluesectionhandler, System, = , Culture=neutral,PublicKeyToken=b77a5c561934e089" /> Meridium AB 1818(19)

19 8. Remove the section groups for embeddedhandler located at /configuration/configsections/sectiongroup[name= se.meridiumkalmar.web ]/section [name= embeddedhandler ] <section name="embeddedhandler" type="system.configuration.namevaluesectionhandler, System, = , Culture=neutral,PublicKeyToken=b77a5c561934e089" /> 9. If the se.meridiumkalmar.web sectiongroup definition is empty, remove it as well. configuration/configsections/sectiongroup[name= se.meridiumkalmar.web ] <sectiongroup name="se.meridiumkalmar.web"> </sectiongroup> Remove installed files Remove the Encoder.Core folder (and its included files) from the webservers bin folder. Meridium AB 1919(19)