views:

61

answers:

3

I have built an ASP.NET mvc web application and it seems that some of our users have started making add-ons or extenstions of some type in Firefox to customize the app for them specifically.

Is there any way to not allow this? Can I do something with my app so they have no access to run customizations?

My boss is freaking out over this so much that he wants to limit everyone to using IE8!

+3  A: 

You can't do anything about it.

Any data you send to the client can be modified by the client.

Greasemonkey scripts, add-ons, custom HTML pages that POST or GET to your server are all possible. Your boss needs to understand that the client of a web-application is HTTP requests, not browsers.

Users can even open up a telnet connection to your web server and type in HTTP commands if they want.

Ben S
+9  A: 

Once the markup is delivered to the browser, the browser can do whatever it wants with it.

There's no way to stop that. There's also nothing to stop people from creating IE8 Accelerators, plugins, or installing something like Trixie to achieve the same goal.

And as long as the requests coming to your website are legitimate, there's no way to tell if they were generated by your page or the browser extension.

You're going to have to get over it and allow the users some flexibility.

Justin Niessner
that's what i told him, but i said i would find out for sure
Mike Roosa
+3  A: 

This question has already been answered, but I'd also suggest that you look at what amendments they are making. If people like your site enough to stick with it, even though they aren't happy with the interface, and are prepared to spend the time to change how it works to suit, then maybe you should look at incorporating some of these changes...

Paddy
i agree completely and that's what we plan to do, but my boss is just worried about our data integrity if users are making changes.
Mike Roosa
@Mike Roosa - It's only client side changes - if your application is dealing with server side data, then it 'should' be set up to deal with someone removing client side validation etc...
Paddy