[jira] [Resolved] (TAP5-53) Mechanism to send pointers to serialized data to the client, not the data itself

["Bob Harner (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TAP5-53?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Bob Harner resolved TAP5-53.
----------------------------

    Resolution: Won't Fix

Cleaning up old inactive bugs... this one seems to not have any interested committers for a long time, and the security issues are addressed by the HMAC changes in 5.3.

Feel free to reopen it if if this issue is important to you.
                
> Mechanism to send pointers to serialized data to the client, not the data itself
> --------------------------------------------------------------------------------
>
>                 Key: TAP5-53
>                 URL: https://issues.apache.org/jira/browse/TAP5-53
>             Project: Tapestry 5
>          Issue Type: New Feature
>    Affects Versions: 5.0.15
>            Reporter: Howard M. Lewis Ship
>
> Tapestry has the capability to store much data on the client, whether it is persisted page fields, or Form component action data.  This presents a couple of problems; first, it inflates the size of the rendered HTML stream.  Second, it is a potential security issue, since a hyper-intelligent black hat might find a way to change such data before returning it.
> What if Tapestry stored the associated bytestreams on the server, and provided, in the HTML, just a relatively short pointer (a string id that points to the correct bytestream) to the stream?
> A small amount of additional data on the server side could be used to authenticate the pointer, using the user's session id (if a session exists) and host ip.
> Unreferenced data would be periodically purged.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira