Adding an encryption layer to DataTables.js

Question

I’m currently using DataTables.js with server-site data source written on PHP.

The server-side script gives out the data exactly as required by datatables:

{“iTotalDisplayRecords”:”777”,”sEcho”:0,”aaData”:[[row1],[row2],[row3]]}

Now I would like to add an additional security layer with encrypting the response from the server and decrypting it after it is received by datatables.

I need this as I noticed some of the clients work through HTTPS proxy and the content of some rows get mistakenly blocked.

I’m using this solution for server-side PHP script to give out encrypted content using openssl_encrypt.

Then at client side I have:

function datatable_init (source) {
  $.getJSON(source, function(data) {
    decryptedContent = JSON.parse(CryptoJSAesDecrypt(“password”, data));
    oTable = $(‘dtable’).dataTable({
      “bProccesing”: false,
      “bServerSide: true,
      //“sAjaxSource”: source,
      “data”: decryptedContent
      ...
    });

I had to replace ”sAjaxSource” to ”data” as it is different datasource type now which requires different type of datatable JSON format:

{data:[[row1],[row2],[row3]}

and I can’t to pass iTotalDisplayRecords anymore.

Is there a way I can keep feeding server-side format of JSON to datatable but feed it as a local JS object/array?

P.S. Another idea I had is to encrypt/decrypt each individual row of the table but that’s probably going to be more complicated and slower

Encrypting anything to be decrypted client side by a browser is entirely pointless as the client can't be trusted — eddiewould
– eddiewould, Commented Jun 23, 2019 at 22:06
@eddiewould But I will go by the proxy at least. Otherwise, is a browser extension will be better security-wise? — user164863
– user164863, Commented Jun 23, 2019 at 22:10
1) Ensure your API is served only over HTTPS to prevent eavesdropping 2) Ensure your have appropriate authentication & authorization mechanisms in place so that you know who accessing your API and that they have permission to do so. — eddiewould
– eddiewould, Commented Jun 24, 2019 at 0:00
@eddiewould Yes, I have that. Would a session_id be a good password for JS encryption in this case? — user164863
– user164863, Commented Jun 24, 2019 at 0:23
The third party proxy can't decript the traffic (unless something has gone wrong) - HTTPS is end-to-end encryption - that's the whole point of it. — eddiewould
– eddiewould, Commented Jun 24, 2019 at 11:57

Javan · Accepted Answer · 2019-06-23 22:35:25Z

1

The ajax.dataSrc option seems to be helpful, because it provides the possibility to modify the data received via ajax and thus allows you to define a function which takes care of decrypting the received data again. Especially the last example given on the reference page looks promising in my opinion.

answered Jun 23, 2019 at 22:35

Javan

1891 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Adding an encryption layer to DataTables.js

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related