MSAMM
Back to course

Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what

Filter at the source

Lesson 111 of 176 · 2 min

Making the service return ONLY WHAT THIS USER MAY SEE. What that requires of THE CONNECTION DECISION IN MODULE 6. Lessons 2 and 3 both end here, and this is where the fix actually is. FILTERING AT THE SOURCE MEANS THE REQUEST CARRIES THE RESTRICTION AND THE RESPONSE CONTAINS NOTHING ELSE. The department filter is a query parameter rather than a step in your page; the salary field is not in the field list rather than hidden in the table. AND THE IMMEDIATE PROBLEM IS THAT A PARAMETER YOUR PAGE ADDS IS A PARAMETER THE USER CAN CHANGE. A request filtered to department 4 can be re-sent asking for department 7. So filtering at the source is necessary and, on its own, is not sufficient — it moves the data out of the response and leaves the restriction editable. WHICH IS WHERE MODULE 6'S CONNECTION DECISION DECIDES EVERYTHING. With a…

The full lesson is part of the course

The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.

See the course and enrol9 free lessons

Get the free lessons by email

We will email you a link to every free lesson in this course. No account needed, and one message only.

In this module: Module 11 · Security: who sees what

  1. 1Where the trust boundary is
  2. 2Filtering in the UI is not securityFree preview
  3. 3Hiding a field sends it anyway
  4. 4Filter at the source
  5. 5Identity propagation, properly
  6. 6Roles inside your application
  7. 7Securing business object endpoints
  8. 8Secrets do not go in an application
  9. 9What ends up in a log or a URL
  10. 10What breaks: four security findings
  11. 11Lab briefing · Attack your own application