JSP or Offline Entry Utility ? Help Pls !!

[Guest_imported]

Dear Friends.......

I am working on a B2B Site where the Security is of Prime Importance, specially the Information entered by Bidder
should be highly secured. No one should be able to see it.. not even the Site Administrator.

The tools we are using is J2EE, WebLogic, oracle8i

Concern 1 :
-----------------

We have a form which is really long. The bidder has to fill about 30 Diff. Details for every Item and sometimes one Bid can have
more than 20 Items too. So U can imagine... how lengthy the form can be ! Whatever the Bidder fills on this page, should
get encrypted at the client side itself (We are planning to use an Applet to do that) ... and once everything is encrypted...
only then it should leave client machine. Un-Encrypted Data should never go to Server ! This is Client Requirement !!!

Since providing such a long form is not a good idea we thought of having a main page and some pop-ups ! ie on main
page there will be links like 'Add Details' etc... clicking on that will take the user to Pop-up where he can enter data.
just like 'Add/Edit Attachment' on yahoo mail Compose Screen ! But the concern here is... how do pass Data between
that pop-up and the main page without making a server Trip ? Coz... the moment we say server trip we are breaching
security coz... the client does not want 'Un-encrypted' data to go to server.

If we want to provide all items in one form... then we anticipate problem of Session Time out, since the form is really tooooo long !


Concern 2 :
-----------------

One alternate we could think is... Offline Entry utility ! ie where the form (As designed by the Buyer) should get downloaded
to Bidder's PC... where he can fill it on his PC leisurely... and once he is thru... he can Encrypt and upload..... so
those Encrypted Items will be stored into DB.

Could anyone pls help me on this ? Any suggestions ?

Rgds and Thanx

Prashant Kamath

 

[Guest_imported]

Dear Prashant,
You do not want to consider offline method due to business
strategy.The user may take his own time and have second thought.My suggestion will be that divide the form into different steps to be completed.As far as security is considered, I do not think you have to encryt data at client
side.Take sensitive data to server over https.
At server side encrpt data and then put in the database.

 

[cnuguri]

In javascript, window.opener refers to the window that opened the current popup window.
so you can use this in the popup to send the values to the main window.

example :
write the following in the popup window.
window.opener.document.OrigForm.input1=document.popupForm.input1.value;

I hope, this will be helpful.

cheers.

 

[cnuguri]

sorry..

it should be

window.opener.document.OrigForm.input1.value=document.popupForm.input1.value;

cheers.

 

[Guest_imported]

You may want to consider using the script provided by this link

http://javascript.internet.com/forms/popup-picker.html

Select an item from the list and the selected value is passed to the form field of the original window, and the pop-up closes automatically.


Jason Sevilla

http://www.hostbest.com

 

[wushutwist]

You could consider using Webstart to start a thick client written in Java on the user's machine. The client will maintain all state throughout the order entry and then when the user is finished the client can encrypt the contents of the message send it back to the server over HTTPS.

We have done this in the past and it has worked out well. It is much easier than maintaining state over multiple HTTPS requests/responses and you can give the user a much richer experience than you would be able to do with just a webpage.

Webstart is pretty firewall friendly since it is delievered over HTTP, though you will need to sign the Webstart Application in order to make your HTTPS connection (which btw is a pain to setup). Despite some of the difficulties in working out the configuration details, Webstart is much better solution than running applets.

 

[iSeriesCodePoet]

HTTPS is verys secure. I would think a web application would work great. Mike Wills
AS400 Programmer

http://www.koldark.net

Please, if you find my post useful, let me know.