通过 ASP.net 中的客户端控件公开服务器端状态
希望这不是一个多余的问题——我不太确定如何措辞。假设我在 ASP.net 页面上有一个项目列表。该列表是可选择的，因为每当用户单击其中一个时，页面就会进行回发，并且服务器代码将图片的索引或某些唯一标识符存储在 ViewState 属性中，指示当前已选择该图片。
我想最大限度地减少服务器上的负载，因此我想在客户端以某种方式存储表示图像的索引或唯一标识符。我能想到的最好方法是将所述信息存储在隐藏字段中），但是在我发疯之前我对此有两个问题：
这是否以任何方式、形状或形式构成安全风险（即，暴露页面的实现细节）？
有没有更好/最好的方法来做到这一点，更符合行业标准？ ASP.net 是否提供了一个比我的想法更干净的框架来执行此操作？看来这对我来说是一个相当普遍的要求...
我已经在 ASP.net 工作了大约两年了。请友善一点:-)
最好， 帕特里克·科祖布
Hopefully this isn't a redundant question--I'm not really sure how to word it. Let's say I have a list of items on an ASP.net page. That list is selectable in that whenever the user clicks on one, the page does a postback and the server code stores the index or some unique identifier of the picture in a ViewState property indicating that it is currently selected.
I would like to minimize the load on the server and therefore I would like to store the index or unique identifier representing the image in some way on the client side. The best way I can think to do this is to store said information in a hidden field ), however I had two questions about this before I go crazy:
Is this a security risk in any way, shape or form (i.e., exposing implementation details of the page)?
Is there a better/best way to do this that is more industry-standard? Does ASP.net provide a framework to do this that is cleaner than my idea? Seems like this would be a fairly common requirement to me...
I have been working in ASP.net for about two years now. Please, be kind :-)
Best,
Patrick Kozub
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
唯一的安全风险是某些列表项必须保持不可选择。听起来您的情况并非如此。用户已经知道该信息，因为他或她已经选择了该项目。
注意：如果服务器对该信息执行了任何操作并将其从用户处拉回，则您必须验证索引值。否则，用户可以将其更改为无效索引，例如 (-2)，并触发异常。
您可以将索引（或相关值）存储在全局 JavaScript 变量中。如果您要避免返回服务器，.NET 就没有真正发挥作用。
The only security risk would be if some list items must remain non-selectable. It sounds like that is not the case in your situation. The user already knows the information, because he or she already selected the item.
NOTE: If the server ever does anything with that information and pulls it back from the user, then you must validate the index value. Otherwise, the user could change it to an invalid index, such as (-2), and trigger an exception.
You can store the index (or related value) in a global javascript variable. If you're avoiding a trip back to the server, .NET doesn't really have a role to play.