JSON Schema for AJAX request
JSON Schema for AJAX request
Wernfried
Posts: 61Questions: 14Answers: 0
Hi Allan
I have a question regarding security. One important rule says "Treat all user-supplied data as untrusted." A common way to ensure security is to validate user-supplied data against a JSON Schema. I have not found any JSON Schema for datatable ajax data. I only found Server-side processing: Sent parameters
I would like to contribute to this part. I already created a working (at least for me) JSON Schema, including also parameters for ColumnControl and SearchBuilder extension. It is also extendable to support extra parameters
Of course, I could copy/paste the schema here as text, however I think it would make more sense to create a PR in your github repository.
What do you think? What would be an appropriate place for it?
Best Regards
Wernfried
Replies
Hi,
The data sent to the server, by default, is HTTP parameters, rather than JSON in the request body (although that can easily be done using
ajax.submitAs), so a JSON schema isn't something that would be used in the default case.However, as noted, JSON can be sent, and a JSON schema can be both useful for validation and for documentation.
That's a good question - probably in the manual. It could possibly go in the server-side library packages, but I think the manual would be an appropriate place for it. Another option would be a new distribution package - JSON schemas aren't something I've worked with for a number of years now, so I'm not familiar with the current distribution standards.
The manual being the current target, if you just paste what you have in here, I can get it in and onto the site.
Allan
Hi Allan
I created the JSON Schema, due to size you will find it at https://live.datatables.net/fovisime/1/edit?js
Some notes:
additionalPropertieswas introduced in JSON Schema Draft 2019-09. If you use an older version, then this property may be silently ignored which makes the schema less strict.$defswas also introduced in Draft 2019-09, before it wasdefinitions. However, most validators supports both keywords - but you never know."$schema": "https://json-schema.org/draft/2019-09/schema". Not every validator evaluates this.$ref: 'datatables.net#/$defs/stateRestore'Example usage:
Consult the documentation of your validator for more details.
If you extend your data with ajax.data then you must extend also the JSON schema.
Assume you extend your payload like this:
Then you need to reference the schema and extend it like this:
Allow extra parameter
user_id:Require extra parameter
user_id:Allow arbitrary extra parameter:
Kind Regards and enjoy
Wernfried
Hi Wernfried,
Absolutely brilliant - thank you! I'll do some research to see if there is a way that JSON schemas can be published so they can be used for development.
Allan