Protecting javascript based on role

To set up what i am going to ask, allow me to explain the page:

I've got a page that shows reports with a popup panel that has all sorts of options on it.... when i first load the page, i show/hide/fill these options based on Roles

The page does not do any post backs, just javascript calls to webservices and i show the report data based onthis blog post by Scott Guthrie (using a page instance, a user control and generating/grabbing the HTML)....

In the aspx markup of the page is hundreds of lines of javascript i have written over the past week, and what i am realizing is that all the script is there for the world to see regardless of role....

So where i may say: $get('drpManager') , that is a control that is only available to certain role (i set visible and enabled to false if the user isn't allowed to see it), but just seeing that in the code, a malicious user may be able to figure out how to do something that they shouldn't be allowed to...

So what I am asking/wondering is maybe some ideas to package the javascript, broken up into role specific functionality, into the page execution and spit it out (this cried out WebResource and ScriptManager.RegisterScript) based on role

Any thoughts on this or pointers?

Unfortunately ( and I hope someone with greater knowledge than I will lambast me for saying something inaccurate)... is no - there is no such thing as security when it comes to scripts. This is the only primary reason I handle everything from the server side when it comes to security specific issues...You can however authenticate using the profile feature of Ajax...but even if you use any of the number of javascript encryptors available (most will not work with Ajax anyways). You will be exposing your logic to those whom realize that you are doing something sensistive..

Naturally you could could create seperate javascripts depending on the role it would be more secure - but if you are using anything Ajax in a security related enviroment - it is my recomended best practice handle it serverside and not clientside... the less the client knows what is going on means the less a hacker knows what is going on... Ajax is afterall just a tool... and security wise - its is the the subject of numerous related security articles because there really is no framework to protect against plain text script... but I would not rely on a global and executing based upon parameters sent to the client on the client...if you must and refuse to do the stuff server side and take the perf hit while maintaining the ajax ui glitz for the customer... then send only the scripts to the client that are related for the role they have...

jodywbcb:

then send only the scripts to the client that are related for the role they have...

Apparently you missed the whole entire point of my topic and the question i asked at the very end, as the above line by you that i quoted is exactly what i was asking for ideas onhow to do...

I wasn't asking for page architecture advice... the page is big and it's fast as hell and getting/updated/refreshing sections of the report piece by piece via AJAX, which absolutely is the best way for this page to serve it's existance, now i am just asking about steps, even if it's just a little step, on keeping code out that a lesser role doesn't need

Prototype and Rico library port of Rounded Corner functionality

Good morning!

As an exercise, I recently ported the rounded corner feature provided by theRico javascript libraries based on the open sourceprototype libraries. I ported that function as an Extender in Atlas, and I it turned out pretty well. I was wondering if anyone here would be interested in checking it out. If so, I will post it on myweb site for interested parties to download.

Check out the Rico link above and view the "Rounded Corner" samples to see the functionality I am talking about.

Answer here to let me know if there is interest, so I know to do it.

I would be very interested in seeing that - please post to your site if you don't mind.

-Josh

yes, please share - sounds good!
Very cool!
Okay, everyone! I will post a link to an example later tonight!

Okay! I was a little late, because I had to fix a bug in the Rico library related to padding! But here it is atmy web site!

Feel free to check it out and tell me what you think! It implements all the semantics of the Rico rounded corner library exactly.

Fantastic work!

I will be playing around with this over the weekend.

Awesome... this is great to see... and a great example of what behaviors are all about.

Question about atlas and web interface update

Is the following scenario possible with atlas:

A web based application is run on a server, so clients use web browser to access it. The application uses inforamation from a database to populate the UI with the information. The information is stored in a database and can be changed either from the application or some other source (lets say another server). Is is possible to update the UI on a user's computer when the database is updated from the other server (the user doesn't need to refresh the screen manualy)?

Thanks in advance,
Marko Vuksanovic.

hello.

well, it's possible, though probably not as you wanted. what you must do is poll the server from the client from x to x seconds and if there's new info, then refresh the client. the most common approach is:

1- wrap the contents that need to be refreshed with an updatepanel

2- call the web service from x to x seconds; if there's new info, then refresh the panel.

Question about AutoComplete textbox

The ASP.NET AJAX Control Toolkit AutoComplete textbox uses a webservice to retrieve a list of suggestions "based on what the user has typed in". I want to create a list of suggestions based on "what the user has typed in" PLUS "the values of some other fields on the form". How can this be done? I don't see a way to access the other field values within the webservice that the AutoComplete textbox uses.

Seems like a reasonable feature request. I have opened work itemhttp://www.codeplex.com/AtlasControlToolkit/WorkItem/View.aspx?WorkItemId=8414 to track this.

Thanks,

Kirti

Thanks Kirti, that would be great! Is there a temporary workaround I can use? I need to auto complete a textbox for zip codes. The zipcodelist is limited to the country the user selects in a dropdownlist. The the autocomplete webservice should take country as additional parameter.

Question regarding AJAX, Blinq etc

Ive noticed lately Microsoft are introducing AJAX, Atlas, WPF,Blinq and many more new technologies.

My question is based on myself being a relatively newcomer to ASP .Net 2.0 and dont know everything but know some as ive developed more with applications rather than websites. So am i wasting my time in learning ASP .Net 2.0 as these new technologies means ASP .Net 2.0 will become "redundant" or "not a standard"? should i concentrate learning these new technologies or continue learning ASP .Net 2.0 as these new technologies will fall in place at some stage?

Thanks

EssCee

ASP.Net 2.0 is the foundation for these technologies, so in my opinion learning asp.net first is fundamental to understanding these other "enhancement" technologies. For example, ASP.NET AJAX (formerly Atlas) is simply an extension to asp.net...not a seperate technology unto itself. Blinq is basically dynamically creating asp.net pages from a data source...so again, built on top of asp.net.

WPF is slightly different I believe in that it is centered around building windows client applications...specifically building nice GUI's to windows client applications. It is more an extension of .Net as a whole than just ASP.NET...I think anyway (someone feel free to correct me).

Matt