0

After talking to a few people, and asking around here, I feel like the only way to securely do calls asynchronously is with an updatepanel.

(Context: Creating an Upvote/Downvote system on SharePoint inside a Site Definition)

I have a Repeater nested inside an UpdatePanel that is successfully making the data calls, and fairly quickly it seems.

I did this for security reasons. I wanted to remove the possibility of vote hacking which could be quite easy with an AJAX based solution.

Am I making the wrong call? Would you stick with AJAX regardless of security? Is worrying about general site users injecting javascript to cheat a company intranet QA site just a little over the top?

Improve this question
1
  • why do you say an update panel is more secure? Behind the scene there is still some Ajax calls.
    – Steve B
    Jul 3, 2012 at 0:32

2 Answers 2

Reset to default
2

On the security side UpdatePanel and pure AJAX are exactly the same. When posting using AJAX you can also check CurrentUser

The differences between UpdatePanel and pure AJAX are:

  • Ease of implementing. UpdatePanel is very easy. Pure AJAX requires more work
  • Performance. UpdatePanel is doing a full page postback, just skipping some rendering parts. Pure AJAX is only doing what you want it to do.
Improve this answer
2
  • But the UpdatePanel is firing button_click events which trigger server side code. If I use JQuery for example, I expose my entire List Update method client side. Doesn't the UpdatePanel allow me to hide siginificant parts of the code Server Side?
    – Wesley
    Jul 9, 2012 at 20:15
  • When using AJAX you have the option of either doing everything using the Clint side OM, which will expose your code to 'view source' or to create your own web service with all the logic hidden and then just call that from JavaScript. The real security comes not from hiding your code, but from the fact that you can set up access so users can't change the list except through server side code, but that server side code can be in a web service or in a button click event, or the check could be in an event receiver.
    – Per Jakobsen
    Jul 10, 2012 at 4:12
3

Since it is an intranet, I think worrying this much is a little over the top.

I guess with fiddler around, anyone can modify their ajax response to the server, so I guess I'm not really following you about why an update panel is more secure than another implementation (such as icallbackeventhandler)? Are you counting on the postback security validation as what you are defining as security?

Improve this answer
1
  • Using an updatepanel allows me to set variables such as who is submitting a vote server side. I can essentially just expose a method like "Upvote" and allow the server to validate CurrentUser and HasVoted, etc...
    – Wesley
    Jul 3, 2012 at 3:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.