Announcement: 4

WCF Data Services announcement

  • Link
    Latest Releases for WCF Data Services
    Matt Meehan - MSFT

    RTW: 5.4.0

    Prerelease: Coming soon


  • Link
    Important: ASP.NET Security Vulnerability
    Andrew Conrad

    Over the weekend the ASP.NET team released a Microsoft Security Advisory about a security vulnerability found in ASP.NET:

     

    http://www.microsoft.com/technet/security/advisory/2416728.mspx

    The WCF Data Services team looked into the issue and don’t believe there is any additional exposure to the vulnerability beyond what is exposed by ASP.NET.   However, if the WCF Data Service is hosted in ASP.NET, it is quite possible that the vulnerability is present.  If any users use the ASP.Net encryption logic to hide sensitive information from the client and use that encrypted data to make decisions in the WCF Data Service, they can run into this issue. Below are few examples:

     

    ·         If you use an encrypted cookie to make decisions to which database to connect in CreateDataSource method

    ·         If you use an encrypted cookie to figure out whether the user is an admin rather than using RoleManager in the server

    ·         If you use an encrypted cookie to apply business logic in change/query interceptors

     

    For a complete description of the vulnerability, please read Scottgu’s post on the subject:

     

    http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

     

    Andrew Conrad

    WCF Data Services Development Lead

    Microsoft Corp

  • Link
    Learn all about the Open Data Protocol (OData) -- the protocol used by WCF Data Services
    Mike Flasko 2

    New to OData?  Go to http://odata.org to learn the nuts and bolts of the protocol, see who is using it today, and learn the scenarios that drove the creation of the protocol. 

  • Link
    WCF Data Services Voting Site Now Available!
    Shayne Burgess - MSFT

    The WCF Data Services team is beginning to explore improvements and new features for our next release.  As part of this process, it’s critical that we hear your feedback, as it helps us ensure that what we build actually meets your requirements in real-world scenarios.  To enable this we’ve launched a new site that will allow you to interact more directly with the development team and provide input: http://dataservices.mswish.net .

    The site’s pretty simple and self-explanatory – you can add a new feature request or vote for feature requests that are already there. We hope you’ll try it out and vote on the features you most want to see added.  Finally, as features move from ideas into actual development we’ll post our thoughts and ideas to the team blog at http://blogs.msdn.com/astoriateam

     

    -Mike Flasko

    Lead Program Manager, Microsoft

Announcement: 4

WCF Data Services announcement

  • Link
    Latest Releases for WCF Data Services
    Matt Meehan - MSFT

    RTW: 5.4.0

    Prerelease: Coming soon


  • Link
    Important: ASP.NET Security Vulnerability
    Andrew Conrad

    Over the weekend the ASP.NET team released a Microsoft Security Advisory about a security vulnerability found in ASP.NET:

     

    http://www.microsoft.com/technet/security/advisory/2416728.mspx

    The WCF Data Services team looked into the issue and don’t believe there is any additional exposure to the vulnerability beyond what is exposed by ASP.NET.   However, if the WCF Data Service is hosted in ASP.NET, it is quite possible that the vulnerability is present.  If any users use the ASP.Net encryption logic to hide sensitive information from the client and use that encrypted data to make decisions in the WCF Data Service, they can run into this issue. Below are few examples:

     

    ·         If you use an encrypted cookie to make decisions to which database to connect in CreateDataSource method

    ·         If you use an encrypted cookie to figure out whether the user is an admin rather than using RoleManager in the server

    ·         If you use an encrypted cookie to apply business logic in change/query interceptors

     

    For a complete description of the vulnerability, please read Scottgu’s post on the subject:

     

    http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

     

    Andrew Conrad

    WCF Data Services Development Lead

    Microsoft Corp

  • Link
    Learn all about the Open Data Protocol (OData) -- the protocol used by WCF Data Services
    Mike Flasko 2

    New to OData?  Go to http://odata.org to learn the nuts and bolts of the protocol, see who is using it today, and learn the scenarios that drove the creation of the protocol. 

  • Link
    WCF Data Services Voting Site Now Available!
    Shayne Burgess - MSFT

    The WCF Data Services team is beginning to explore improvements and new features for our next release.  As part of this process, it’s critical that we hear your feedback, as it helps us ensure that what we build actually meets your requirements in real-world scenarios.  To enable this we’ve launched a new site that will allow you to interact more directly with the development team and provide input: http://dataservices.mswish.net .

    The site’s pretty simple and self-explanatory – you can add a new feature request or vote for feature requests that are already there. We hope you’ll try it out and vote on the features you most want to see added.  Finally, as features move from ideas into actual development we’ll post our thoughts and ideas to the team blog at http://blogs.msdn.com/astoriateam

     

    -Mike Flasko

    Lead Program Manager, Microsoft