[prev in list] [next in list] [prev in thread] [next in thread] 

List:       mozilla-crypto
Subject:    Re: Dynamically created html and signed script
From:       Scott Rea <scott.rea () identrus ! com>
Date:       2003-11-18 22:29:51
[Download RAW message or body]

Folks,

There will always be a trade off between functionality and security... 
security sandboxes were created to protect us from ourselves.

I agree it is very inefficient to create a signed jar-file on the fly 
for each user - but it is not necessary to do this. Simply create a 
single signed jar-file that consists of a blank html page with all the 
JavaScript functions you need (including asking for appropriate 
permissions) then open this in a child window to your dynamic user HTML 
page and call the required signed functions in the child window from 
your parent window, then close the child window when you are done.

Works like a charm!

-Scott

Marek Mänd wrote:

> Harri Hohteri wrote:
>
>> In order to request privileges one needs to sign the HTML page with 
>> all the
>> scripts included. If the HTML page is dynamically created depending 
>> on the
>> charasteristics of the user, the server needs to create a signed 
>> jar-file
>> on-fly for this user. 
>
>
> In fact most of the sites of today have dynamic content not to mention 
> web based database applications. I am also confused about that signing 
> thing and I have given also the same thoughts, you are not alone, but 
> sorry, I am same as lost as you are, anteeksi ;)
>
> What I am after for is opening a modal window as it used to be in 
> Mozilla1.2.1 but now requires weird permission stuff.
>
> >Is this really this unefficient or have I
> > misunderstood something somewhere?
>
> If it is that way, "unefficient" isnt the right word. "idiotism" is.
>
> _______________________________________________
> mozilla-crypto mailing list
> mozilla-crypto@mozilla.org
> http://mail.mozilla.org/listinfo/mozilla-crypto


_______________________________________________
mozilla-crypto mailing list
mozilla-crypto@mozilla.org
http://mail.mozilla.org/listinfo/mozilla-crypto
[prev in list] [next in list] [prev in thread] [next in thread]