cayenne-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Peter Schröder <Peter.Schroe...@freenet-ag.de>
Subject AW: Cayenne web application tutorial
Date Thu, 12 Apr 2007 13:28:42 GMT
we use hashvalues to detect hacking-attempts. we create a md5 hash with the encoded value and
some secret key and put it with the other parameters, so that the receiving component can
check if the value has been edited bye comparing hashvalues.

kind regards peter 

-----Ursprüngliche Nachricht-----
Von: Michael Gentry [mailto:blacknext@gmail.com] 
Gesendet: Donnerstag, 12. April 2007 15:23
An: user@cayenne.apache.org
Betreff: Re: Cayenne web application tutorial

Just a note (yes, this is one of my soapboxes and Steve and I discussed this
ages ago): If you need data security in your application, don't use the data
squeezers with Tapestry.  The squeezers are great if you don't care about
security, but if you do, they are too problematic for someone who wants to
try hacking things.  They encode primary keys to your data objects, which
can be altered by someone before being sent back to you, causing
(potentially) incorrect records being retrieved/updated.  (At least the last
time I looked at it...)

The above isn't meant to detract from Steve's tutorial, either, which is
great and we are the better for having it available.

Thanks!

/dev/mrg


On 4/12/07, Peter Schröder <Peter.Schroeder@freenet-ag.de> wrote:
>
> it was a perfect tutorial to my work on a new job. it was exactly what we
> are now using here as development-environment.
>

Mime
View raw message