tapestry-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Andreas Andreou (JIRA)" <...@tapestry.apache.org>
Subject [jira] Commented: (TAPESTRY-1797) Mechanism to send pointers to serialized data to the client, not the data itself
Date Tue, 02 Oct 2007 14:49:50 GMT

    [ https://issues.apache.org/jira/browse/TAPESTRY-1797?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12531816

Andreas Andreou commented on TAPESTRY-1797:

Have you seen http://www.hdiv.org/ ?

It looks like exactly what you're talking about + I've been wanting to see how it could be
integrated into 4 as well

> Mechanism to send pointers to serialized data to the client, not the data itself
> --------------------------------------------------------------------------------
>                 Key: TAPESTRY-1797
>                 URL: https://issues.apache.org/jira/browse/TAPESTRY-1797
>             Project: Tapestry
>          Issue Type: New Feature
>          Components: tapestry-core
>    Affects Versions: 5.0.5
>            Reporter: Howard M. Lewis Ship
> Tapestry has the capability to store much data on the client, whether it is persisted
page fields, or Form component action data.  This presents a couple of problems; first, it
inflates the size of the rendered HTML stream.  Second, it is a potential security issue,
since a hyper-intelligent black hat might find a way to change such data before returning
> What if Tapestry stored the associated bytestreams on the server, and provided, in the
HTML, just a relatively short pointer (a string id that points to the correct bytestream)
to the stream?
> A small amount of additional data on the server side could be used to authenticate the
pointer, using the user's session id (if a session exists) and host ip.
> Unreferenced data would be periodically purged.

This message is automatically generated by JIRA.
You can reply to this email to add a comment to the issue online.

To unsubscribe, e-mail: dev-unsubscribe@tapestry.apache.org
For additional commands, e-mail: dev-help@tapestry.apache.org

View raw message