0

In every app, we are always getting requests that simply take data from a file and import them into the system or export from system to file/ftp etc. This is mostly used internally by the administrators. Basically they need a screen to enter some info, click a button and the import/export will be carried out.

The system I am developing is using n-tier architecture: Web App (Browser) > Controller > WCF Service > Data Layer > Db.

I have created a design and it is currently in use which basically works like this:

  1. Create a screen
  2. Controller will create an instance of a class that has some info in it such as the name of the stored procedure, the parameters to the stored procedure etc. and submit this to the WCF service.
  3. The WCF service, the repository will be re-used since it simply forwards the request over to the db and performs some security work. The repository will issue the request to the correct stored procedure to be executed.
  4. The appropriate stored procedure is executed and the result is exported to a file by TSQL or imported into the db.
  5. Some result is returned to client.

The above solution is good, I guess, since I just need to create the screen, the controller method and the stored procedure. The stuff in between can be reused.

I am thinking of taking the responsibility of creating the class outlined in step 2, within Javascript and that way the only code I would need to write is the screen and the stored procedure. The controller, WCF, repository and security can be reused.

Cons

The problem is that I was even reluctant to allow the controller to dictate which stored procedure should be executed. It seems it is a leakage of implementation details. And now that I want to promote this to Javascript, I am even more reluctant hence I am asking here.

Pros

Although it is implementation leakage but this is for our internal use. These operations can never be called by the public. It is controllerd using authentication/authorization. This design results in less work for us and we can satisfy such requests pretty quickly with minimal coding.

If you could please shine some light on the above approaches or share what you have done in the past, that will be great!

|improve this question
  • It is still a security vulnerability if that is what you a worried over. It exposes internals that would normally require access to the server/db themselves. A suitably skilled and irritated administrator could easily pass through a different proc (and if they are that kind of admin what about the proc to create a new admin?). Perhaps pass a key into the controller, have the controller map that to a proc. You can still reuse the mvc, etc... but at least now its limited to just these x options. The table itself is not hard to maintain. – Kain0_0 Oct 30 at 4:39
  • @Kain0_0 We log everything any user does. These admins even have have access to the db so if they have ill intentions, I cannot stop them. Having said that, passing the key is a good idea. – CodingYoshi Oct 30 at 14:15
  • good to see you've got some common sense precautions in place. But that level of access would only make me even more worried about your admins credentials being breached. – Kain0_0 Oct 30 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.