Mechanism to send pointers to serialized data to the client, not the data itself
--------------------------------------------------------------------------------
Key: TAPESTRY-1797
URL: https://issues.apache.org/jira/browse/TAPESTRY-1797
Project: Tapestry
Issue Type: New Feature
Components: tapestry-core
Affects Versions: 5.0.5
Reporter: Howard M. Lewis Ship
Tapestry has the capability to store much data on the client, whether it is
persisted page fields, or Form component action data. This presents a couple
of problems; first, it inflates the size of the rendered HTML stream. Second,
it is a potential security issue, since a hyper-intelligent black hat might
find a way to change such data before returning it.
What if Tapestry stored the associated bytestreams on the server, and provided,
in the HTML, just a relatively short pointer (a string id that points to the
correct bytestream) to the stream?
A small amount of additional data on the server side could be used to
authenticate the pointer, using the user's session id (if a session exists) and
host ip.
Unreferenced data would be periodically purged.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
