Hi,
How can I let the client draw a signature on the Phone or tablet?

Hi,
Does anyone know how to let the app size respond on the device and screen size and the position (landscape / portrait)?
I've tried WebApplication.FormHeight

I have been using IWMemo to display log files to the user and in the past have not had any problems; at least that I could find.  In the latest versions however, I am not getting the web browser to display all of the lines that are read in using LoadFromFile.  I even tried adding the lines one at a time using a separate read function but it still will only show about 273 lines of my text file.  Some of these logs can get VERY large.  Is there a way to increase the "size" of the data in the IWMemo component?  Is there another component that might work better?  FYI - currently using IntraWeb 15.1.9 in Delphi 10.2 but the problem is in versions created several months ago also.

Thanks!
David C

One of my web apps is being PCI certified.

1. How do I restrict ciphers from being used?

For example, I want to disallow ciphers
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
.. and others

2. I have an auditor querying if we can prevent ECDH public server param reuse

Is this possible and if so how.


TIA

I'm researching how to get our web application to be more secure and it seems that using one of the existing account management system like Auth0, FusionAuth, Okta, IdentityServer or  Keycloak would be the best solution. 

Did any of you use one of the account management systems available, with Delphi and IntraWeb? 

Any advice or direction is greatly appreciated.

We have a third party company that is reviewing our websites.

They have reported some security issues that they are requiring us to address.


---------------------
Here is their description of the problem:  Cross Site Scripting

The "callback", "ajaxevent" and "ArowId" parameters found on https://site.somewhere.com/iw/Isiw.dll//$/callback can be modified to include executable JavaScript.

Note: The request requires a valid 'IW_SessionID' value that can be obtained by going to the application (no authentication required)
----------------------------

It sounds to me that they think a user can grab a session_id from the site and then use it to do an ajax callback with some malicious code.

Do you have How do I mitigate this risk?

We are currently using iw 14.  Are there some changes in iw15 that would help?

Users are demanding that the user name entered during log in be used for intraweb app. They say i should use LDAP so they do not have to reenter user name and password. Do i use WebApplication.Request.mAuthUser?

There is a function similar to Messagedlg for intraweb
Tanks

Hi,

Apparently TIWFileUploader only works for the Windows platform.

Is that the case or should it also work with browsers on Android devices?

C++Builder 10.3.3

IntraWeb 15.1.22

Regards
Juergen

Hi,

I have found that a new session is always created with an HTTP request
and the OnNewSession event is triggered, whether in the OnBeforeNewSession event
the parameter vCanCreate is set to true or false.

Should a new session not only be created with vCanCreate = true


C++Builder 10.3.3

IntraWeb 15.1.22

Regards
Juergen