Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what
Hiding a field sends it anyway
Lesson 110 of 176 · 3 min
The same defect ONE LEVEL DOWN, and the one people are MOST SURPRISED BY. A HIDDEN SALARY COLUMN IS A VISIBLE SALARY. Module 7 Lesson 6 stated this in passing. Here it is on its own, because hiding a field feels much more like a control than filtering a list does. HIDING IS A DISPLAY PROPERTY. The column is not rendered; the field is in every row of the response. The value is in the variable the table is bound to, and the response is in the network tab — so "hidden" means "not drawn", and nothing more. WHICH IS WHY THE SALARY EXAMPLE IS WORTH KEEPING IN MIND. A worker list with a salary column hidden for most roles is one of the most natural things to build, it looks correct to everybody, and every salary in the list has been sent to every user who opens the page.…
The full lesson is part of the course
The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.
In this module: Module 11 · Security: who sees what
- 1Where the trust boundary is
- 2Filtering in the UI is not securityFree preview
- 3Hiding a field sends it anyway
- 4Filter at the source
- 5Identity propagation, properly
- 6Roles inside your application
- 7Securing business object endpoints
- 8Secrets do not go in an application
- 9What ends up in a log or a URL
- 10What breaks: four security findings
- 11Lab briefing · Attack your own application