Server Function Exposure via Auto-Generated Script Serialization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for exposing server functions to browser-based scripting code are limited, requiring explicit code formatting for data exchange and lacking flexibility in making server functions accessible across multiple web pages, with inadequate security against single-click attacks.
Innovation Solution
The approach involves formulating script language functions by the web server that match server-side functions, allowing browsers to call these functions across multiple web pages, with optional serialization of a single-click hack protection token for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If server functions are exposed to browser-based scripting code using conventional methods (ASP.NET Page Method, web services, REST), then data exchange between server and browser is enabled, but explicit code formatting is required and flexibility is limited
Solution Approach 1:
The server automatically generates the script language function code that exposes server functions to the browser. Instead of requiring developers to manually write formatting code, the system self-generates the necessary client-side function definitions and serialization logic, eliminating the burden of explicit code formatting while maintaining full functionality
Solution Approach 2:
The generated script language function serves multiple purposes: it acts as a client-side interface definition, a serialization mechanism, and a communication protocol handler. This single generated function replaces multiple separate components (formatting code, serialization logic, and function definitions) that would otherwise be needed in conventional approaches
2Adaptability or versatility
If server functions are exposed across multiple web pages, then flexibility and reusability improve, but security risks from single-click attacks increase
Solution Approach 1:
A protection token is generated and embedded in the script language function definition before the function is called. This preliminary inclusion of security credentials ensures that when the function is executed across multiple pages, the browser already possesses the necessary authentication information to prove legitimate origin, preventing single-click attacks that attempt to exploit cross-page function calls
3Reliability
If protection tokens are serialized in requests, then security against single-click attacks is strengthened, but request data size and processing complexity increase
Solution Approach 1:
The protection token is merged into the existing request parameters rather than being transmitted as a separate data element. The token is serialized together with the function name and arguments in the same request payload, allowing security verification without requiring additional processing steps or separate validation routines
Data Source
AI summary
The exposing of a server function to a browser. From the browser's perspective, the browser submits a request for a web page to a web server, the web page being one of multiple web pages in a web application offered by the web server. The web server responds to the request by, for at least one of the server functions, formulating a corresponding script language function that defines a matching name and parameter set of the server side function. The script language function has a body that, when executed, serializes at least the name and parameter set of the server side function. The web server then provides the web page code and the corresponding script language function to the browser. The browser may then calls the server side function via the script language function.