Hide Filter Parameters in URL

[Howard G. Cornett]

How do I hide filter parameters so that when I redirect the user to a new filtered page, it does not expose the filter details in the address bar? In other words, if I have a URL that ends in ?filter="000004", how can I hide that they are looking at record "000004"? This could become a real problem if the user is looking things up by any sensitive information, like a social security number?

Howard

[Steve Workings]

RE: Hide Filter Parameters in URL

Rather than use the URL and redirect for a filter, edit the A5W page. This has been discussed here before, but anyway, you'll find something like this already in place.

with tmpl
componentName = "Grid_CCList"
end with

Add a bit to it to get your filtering. Here's one of mine to show only the logged-in member's list of credit cards on file:

with tmpl
componentName = "Grid_CCList"
if eval_valid(session.member_id)
.dbf.filter = "member_id=" + quote(session.member_id)
end if
end with

- Steve

[Howard G. Cornett]

RE: Hide Filter Parameters in URL

Great! Thanks for the help, Steve. Now what if I want to allow the user to click on a link and then redirect him based on the records he clicks on. How do I hide the url in that case?

Howard

[Steve Workings]

RE: Hide Filter Parameters in URL

The URL still shows with the method I described, but it doesn't show the filter that you asked about in your original message.

I'm not sure how to hide the URL, other than to put things in frames. But try what I suggest first, and see if you're happy with the results. Without a filter showing in the URL, I don't know that it needs to be hidden.

- Steve

[Peter.Wayne]

RE: Hide Filter Parameters in URL

If you're really concerned, you need to use SSL encryption. Just hiding the URL won't matter; if someone is sophisticated enough to read the URL without looking over your shoulder, then they're sophisticated enough to read all the traffic going back and forth to your server. Right now (v6) you need to use the Apache module for SSL communications.
If you are only mildly concerned, you can use the md5() function to transfer sensitive info in the URL. For example, if your table has
name, C, 20
SSN, C, 9
SSN_md5, C, 32

then you can set it up so that SSN_md5 is always the md5() of the SSN. Instead of filtering by SSN, then, you can filter a page by the md5() of whatever you're looking for.

[Ren� Stout]

RE: Hide Filter Parameters in URL

Hi Steve,

could you help me out?

I try to use this concept to open a a5w, filtered on Invoice_Id of an invoice in a grid, without the invoice_Id showing in the URL.
My knowledge is to limited to extrapolate your instruction.

So: in the field in the grid I link to Invoice_Detail.a5w, but without the filter statement,

and then in Invoice_Detail.a5w I need to know the Invoice_Id, in order to be able to filter on it.
How does the page know the invoice_Id and what is the syntax for the statement(s)?

I surely wished that the Alpha documentation gave more examples for dummies in stead of just xbasic statements for profs...

Greetings, Ren�

[Lenny Forziati]

RE: Hide Filter Parameters in URL

The HTTP protocol allows pages to be requested using one of two methods, GET and POST. A GET request always shows the full request in the browser's address bar. A POST request only shows the target portion of the URL, but not arguments being passed.

Clicking on a hyperlink is always a GET request. You can perform a POST using an HTML "form" or by writing a Javascript to POST a form for you.

However, this still is not secure - your app user could simply view the source of the page to see what the format of the request is and instead send a request for a different filter. This is true even if you use SSL as Peter suggested.

In order to make this app secure, the filter should not be sent by the client at all. Instead, your login routine should create a protected session variable with this value and then all of your components and pages should use that variable. In this way, the application user has no way to see or modify the filter.

-Lenny

[Ren� Stout]

RE: Hide Filter Parameters in URL

Thanks Lenny, that's clear.

Greetings, Ren�