server only datasources

[paperclip]

I place all my datasource files in /ds/ and then load them through

 
<script src="sc/DataSourceLoader?dataSource=example.ds.xml" />

I have some datasources that should only be invoked server side though (they don't contain any authentication or validation code). My question is: if i don't load them using the script above, can I safely assume a user cannot access them?

[Isomorphic]

No. You should protect them via a custom IDACall servlet that rejects requests to those DataSource IDs, or, if using declarative security, by adding requiresRole="superuser" and only giving the "superuser" role to admins.

[paperclip]

Thank you for the reply isomorphic;

if using declarative security, by adding requiresRole="superuser" and only giving the "superuser" role to admins.

Can you elaborate on this point please? I am using declarative security (form authentication), but in all cases, no user (regular or superuser) should be able to access them. These datasources do house keeping jobs that only the server should be able to invoke under specific conditions.

[Isomorphic]

If they are truly internal functions, just protect them via the IDACall approach. However it frequently turns out that internal functions are very valuable for a superuser to access to diagnose or fix a problem.

[paperclip]

yes that is actually true. I would like to use requiresRole, but would it still work if a non-admin user was logged in? I am assuming putting requiresRole="superuser" in the datasource calls isUserInRole() on the server, which would return false in this case?

BTW, on the server, i use RPCManager.getDataSource() to instantiate and use the "server only" datasource.

[Isomorphic]

That's correct - just see the docs for requiresRole and related properties, it explains this.

[paperclip]

Thanks for the pointers isomorphic;

For anyone else, you can use RPCManager.setUserRoles() to temporary get around the requiresRole="superuser" for that particular queue.