MSAMM
Back to course

Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what

Where the trust boundary is

Lesson 108 of 176 · 3 min

EVERYTHING IN THE BROWSER IS UNDER THE USER'S CONTROL — the page, the variables and the requests. DESIGN FROM THAT, NOT AROUND IT. This module has one idea and the rest is consequences. The idea is that the boundary between what you control and what the user controls runs between the browser and the server, and everything you have built so far is on their side of it. THE PAGE IS THEIRS. They can read its source, see which components exist, and see the ones you hid. The variables are theirs — every value your page loaded is in memory they can inspect, including the fields no component displays. And the requests are theirs: they can watch what is sent, change it, and send it again without your page. NONE OF THAT REQUIRES SKILL OR MALICE. It is the browser's own developer tools, on the page they were given. Which…

The full lesson is part of the course

The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.

See the course and enrol9 free lessons

Get the free lessons by email

We will email you a link to every free lesson in this course. No account needed, and one message only.

In this module: Module 11 · Security: who sees what

  1. 1Where the trust boundary is
  2. 2Filtering in the UI is not securityFree preview
  3. 3Hiding a field sends it anyway
  4. 4Filter at the source
  5. 5Identity propagation, properly
  6. 6Roles inside your application
  7. 7Securing business object endpoints
  8. 8Secrets do not go in an application
  9. 9What ends up in a log or a URL
  10. 10What breaks: four security findings
  11. 11Lab briefing · Attack your own application