in reply to avoid by pass of web interface

I ignored this thread when it came up but it did get me thinking later.

I'm aware that no scheme to force the use of a 'WEB GUI' will be 100% effective, but I thought it might make an entertaining thought exercise.

First thing that came to my mind was that if you've made a nice fat Javascript/forms front-end for some REST/SOAP back-end... then it's all too easy to talk to the back-end once you know the urls and schemas... so basically avoid writing the clean/sexy type of fat GUI that is being currently espoused in AJAXy circles.

Then I thought.... "what is the minimum standard for 'normal' use of the web interface?". Thinking about that makes you figure out exactly which features the client's web browser must have to pass your test.

You could do something nasty like:

  1. have each link/submit URL be generated by client-side Javascript
  2. that url-generating Javascript is patched every time the server returns a new page
  3. if you have multiple AJAX-style requests going simultaneously, then you'll have to implement some sort of 'patch queue' to keep it all straight ;)
  4. all of that could be spoofed by some perl script which embeds a Javascript interpreter, so perhaps you'd need to use some tricky DOM/Canvas manipulations in your Javascript from which your code can extract hard-to-anticipate browser-computed values (very fragile ;)

How far could this be taken? :D

-David