views:

80

answers:

2

We are moving from WebForms to MVC and and using a lot of jQuery.

I appears we have a lot of jQuery/JavaScript in our Views, is this common and are there any concerns about security. The obvious step is to refactor into plugins and more generic UserControls etc, but this jQuery would still be "visible" by looking at js files etc.

We are validating everything on the server-side anyway but should we be concerned?

+1  A: 

As long as you don't have proprietary algorithms or confidential material going down, this is typically not a security concern. (As long as you're also doing server-side validation as you say.)

Coordination and maintenance of these scripts quickly becomes a concern however. MVC doesn't provide the ClientScriptManager control like web-forms does. We're also using a lot more javascript than we did before, even if it is (thank goodness) jquery. See here for an example of how a developer is trying to improve management of these scripts.

Patrick Karcher
+4  A: 

I agree with Patrick in regards to the security issues related to using more javascript. However another thing you might want to consider is to limit the amount of javascript that appears in your view vs in an include file. The more js in a view equals more data that needs to come across the wire and depending on the amount could slow down the load time of your page. At least if generic javascript functions are in include files they could be cached and help to minimize this issue.

amurra