Suggestion needed for consuming OData service

Question

3.67/5 (2 votes)

See more:

I have a business layer written using WCF Data Services (ODATA). I wish to consume them in my web application using JQuery AJAX calls. But my security manager raises concern that jQuery calls can be easily manipulated (and he is right). I want to avoid server side calls as they are costly in terms of postback and page lifecycle.

Please suggest me the fastest way to consume the OData service with effective security. My application needs to run in extranet environment.

Thankyou

Posted 10-Jan-14 19:36pm

Wild-Programmer

Add a Solution

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sampath Lokuge · Accepted Answer · 2014-01-10T20:24:00

Solution 1

Firstly, I have to say your security manager is wrong.This is a Myth.

There is nothing specific in AJAX. It is just a request performed by your browser. It is just general HTTP request and should be secured as any other HTTP request, regardless its XHR nature.

If you maintain proper Authentication and Authorization on your WCF service,You won't have any security issues by using Ajax calls.

The future of the Dev world is Ajax.As an example I can say that SPA enterprise App development.Those apps are developed solely by using Ajax (Or javascript).Check this link for more info : Building Large Scale Apps with Angular and Breeze

Note : The JSON data must be sent over POST, not GET, which would make it difficult to include the URL in <script> tag

Posted 10-Jan-14 20:24pm

Sampath Lokuge

Comments

Wild-Programmer 11-Jan-14 5:02am

I agree to you. But the point he raised was that even an authenticated user can open the html markup and manipulate the data section.

Sampath Lokuge 11-Jan-14 6:34am

What kind of data manipulation you mean ? If you transfer the data through 'post' method, then how can you do that ? If you need more security, you can use 'SSL(https)' for that also with ajax calls.

Wild-Programmer 11-Jan-14 13:28pm

Let me serve you an example:
$("#btnUpdate").click(function () {
// Convert the form into an object
var data = { UserID: 'CMA', UserName: 'CMA' };
// JSONify the data
var data = JSON.stringify(data);

// Post it
$.ajax({
type: "PUT",
contentType: "application/json; charset=utf-8",
url: "http://localhost:7876/TestWcfDataService.svc/Admins(80)",
data: data,
dataType: "json",
success: insertCallback,
failure: errors
});
});

Now the user can copy this section and change the URL from "http://localhost:7876/TestWcfDataService.svc/Admins(80)" to "http://localhost:7876/TestWcfDataService.svc/Admins(82)". How can we ensure that the data inside the call is not manipulated by the user?

Sampath Lokuge 12-Jan-14 1:48am

Don't send data on that way (i.e. Admins(80)).Instead of that put that data in a hidden field and then use that hidden field's value for data request through your url.

Suggestion needed for consuming OData service

1 solution

Solution 1

Add your solution here

Preview 0

Suggestion needed for consuming OData service

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us