MSDN Magazine - September 2008 - (Page 53)

Dino ESpoSito Cutting EdgE Building A Secure AJAX Service Layer A major advantage of AJAX and Silverlight™ apmore coarsely granular services. The presentation plications is that they can transparently and conlayer makes one call to one service in the layer. tinuously interact with a back-end service. The The invoked service layer method will coordinate problem is that they run over HTTP, which wasn’t the objects and workflows in the business layer designed with security in mind. Yet it’s important to implement the required behavior. Figure 2 that you protect these back-end services from unshows the benefits of the service layer. authorized access. So what do you do? In the service layer implementation, it is comThe architecture of a typical AJAX or Silverlight mon to assume that callers have been previously application is shown in Figure 1. It’s essentially a authenticated and authorized. Also, it is common two-tiered architecture with the front and back to place the service layer in an isolated part of the ends neatly separated by the Internet. As a result network, for example behind a firewall. If the cliof this architecture, there is opportunity for unent is an ASP.NET application, you call the serauthorized access between the presentation layer vice layer from within the page code. However, and the back end. because this code executes on the Web server, The back end exposes its API through a collec- Figure 1 A Typical Architecture the call to the service is essentially a server-totion of public URLs. These URLs refer to hosted for a Rich Web Client App server call and occurs in a protected and conservices that are technically part of the applicatrolled environment. No new security concerns tion, yet are exposed as public services. Any high-security barrier arise in this scenario. you could place here (such as a firewall) would stop authorized as Now imagine a service layer in an ASP.NET AJAX or Silverwell as unauthorized calls. It would be quite difficult to complete- light scenario. To enable AJAX or Silverlight clients to call into ly weed out the unwanted access. Obviously, this would be much the service layer, the address of the service layer’s endpoints must easier in an intranet or extranet scenario. be publicly exposed. This means removing any firewalls you may When you choose to take advantage of a Web-based distributed have in the middle. architecture like this, you must expect outsiders to find your serOnly publicly exposed functionality can be invoked from a publicly vices and attempt to exploit them. facing, rich Web client. In protecting your back-end service layer, you could implement a pared-down version of the functionality in The Service Layer question in your ASP.NET AJAX or Silverlight clients. This might Modern distributed systems have an extra layer of code between the presentation and business layers—the service layer. Formalized by Martin Fowler in his book Patterns of Enterprise Application Architecture, the service layer in a distributed application represents an additional layer of code that creates a boundary between two other layers, in this case between the presentation and business layers. The code in the presentation layer typically implements use cases. A typical use case is a sequence of actions performed by the user that result in interactions between one or more business objects, workflows, and services. The service layer allows you to abstract these smaller interactions with an intermediate API, exposed through Send your questions and comments for Dino to cutting@microsoft.com. Code download available at msdn.microsoft.com/magazine/cc135911. Figure 2 The Service Layer Decouples Presentation and Business Layers September 2008 53 http://msdn.microsoft.com/magazine/cc135911

Table of Contents Feed for the Digital Edition of MSDN Magazine - September 2008

MSDN Magazine - September 2008 Contents Toolbox CLR Inside Out Data Points Advanced Basics Office Space Cutting Edge Hierarchy ID New Features for Microsoft SQL Server 2008 Prism Data Services Advanced WPF Test Run Security Briefs Foundations { End Bracket }

MSDN Magazine - September 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.