Hi Rob, Thanks for taking time to reply. And many thanks for the detailed example. Yes, having the secret rendered makes this approach questionable while using encryption. But what you've shared will be sufficient if one were to use other techniques like hashing etc.
On Mon, Jan 16, 2017 at 4:18 PM, Rob Audenaerde <[email protected]> wrote: > > > > Thanks Martin. > > Hi Rob, your approach looks interesting. > > Can you please elaborate on that? > > > > Yes. Although I don't really see the point. The secret that is passed on > will be readable by an attacker if the attacker could otherwise access the > fields in the form, effectively rendering this 'security by obscuriry'. The > only way around this is to pass the secret by other means to the client and > have them provide it in the form, or use some other type of PKI (which is > what HTTPS is supposed to do). > > - > > I would create a Form with a hidden field and an extra attrribute, the > secret: > > Form<T> secretForm = new Form<T> ( ) { ... }; > > secretForm.setOutputMarkupId(true); > IModel<String> encodedResult = new Model<>(); > secretForm.add(AttributeModifier.append("secret", > Model.of("SuperDuperSecret")); > secretForm.add(new HiddenField("secret", encodedResult)); > secretForm.add(AjaxButton asb= new AjaxButton("submit") > { > @Override > protected void updateAjaxAttributes( AjaxRequestAttributes attributes ) > { > super.updateAjaxAttributes( attributes ); > attributes.getAjaxCallListeners().add( new AjaxCallListener() > { > @Override > public CharSequence getBeforeHandler( Component component ) > { > //I think you should do the encoding here, something with JSON, JQuery, > return "encryptFormToHiddenField( " + secretForm.getMarkupId() + " ) " ; > } > } ); > } > }; ); > > > In the onSubmit() of the form you can access the contents of the > encodedResult, use the ''SuperDuperSecret" to decode it. > > Now that I'm writing it, I think you also want to prevent the other values > from being sent.. Maybe you could empy the values using JavaScript? > > > > -Rob > -- Thanks & regards James Selvakumar
