>
> Thanks Martin.
> Hi Rob, your approach looks interesting.
> Can you please elaborate on that?
>
Yes. Although I don't really see the point. The secret that is passed on
will be readable by an attacker if the attacker could otherwise access the
fields in the form, effectively rendering this 'security by obscuriry'. The
only way around this is to pass the secret by other means to the client and
have them provide it in the form, or use some other type of PKI (which is
what HTTPS is supposed to do).
-
I would create a Form with a hidden field and an extra attrribute, the
secret:
Form<T> secretForm = new Form<T> ( ) { ... };
secretForm.setOutputMarkupId(true);
IModel<String> encodedResult = new Model<>();
secretForm.add(AttributeModifier.append("secret",
Model.of("SuperDuperSecret"));
secretForm.add(new HiddenField("secret", encodedResult));
secretForm.add(AjaxButton asb= new AjaxButton("submit")
{
@Override
protected void updateAjaxAttributes( AjaxRequestAttributes attributes )
{
super.updateAjaxAttributes( attributes );
attributes.getAjaxCallListeners().add( new AjaxCallListener()
{
@Override
public CharSequence getBeforeHandler( Component component )
{
//I think you should do the encoding here, something with JSON, JQuery,
return "encryptFormToHiddenField( " + secretForm.getMarkupId() + " ) " ;
}
} );
}
}; );
In the onSubmit() of the form you can access the contents of the
encodedResult, use the ''SuperDuperSecret" to decode it.
Now that I'm writing it, I think you also want to prevent the other values
from being sent.. Maybe you could empy the values using JavaScript?
-Rob
