[[["เข้าใจง่าย","easyToUnderstand","thumb-up"],["แก้ปัญหาของฉันได้","solvedMyProblem","thumb-up"],["อื่นๆ","otherUp","thumb-up"]],[["ไม่มีข้อมูลที่ฉันต้องการ","missingTheInformationINeed","thumb-down"],["ซับซ้อนเกินไป/มีหลายขั้นตอนมากเกินไป","tooComplicatedTooManySteps","thumb-down"],["ล้าสมัย","outOfDate","thumb-down"],["ปัญหาเกี่ยวกับการแปล","translationIssue","thumb-down"],["ตัวอย่าง/ปัญหาเกี่ยวกับโค้ด","samplesCodeIssue","thumb-down"],["อื่นๆ","otherDown","thumb-down"]],["อัปเดตล่าสุด 2024-07-10 UTC"],[[["\u003cp\u003eThis documentation provides information about security considerations, error handling, and logging within the data source library.\u003c/p\u003e\n"],["\u003cp\u003eData sources operate in restricted access mode by default to prevent XSRF attacks, but unrestricted mode can be enabled for cross-domain access.\u003c/p\u003e\n"],["\u003cp\u003eThe library uses \u003ccode\u003eDataSourceException\u003c/code\u003e for errors, with helper functions available to handle these errors in servlet responses.\u003c/p\u003e\n"],["\u003cp\u003eWarnings are used to indicate problems without preventing data table return, like truncated data due to limits or invalid formatting.\u003c/p\u003e\n"],["\u003cp\u003eLogging is handled through Jakarta commons logging, which can be adapted to various logging systems.\u003c/p\u003e\n"]]],[],null,["# Handling Security, Errors, Warnings, and Logging\n\nThis section covers the following topics:\n\n- [Security](#access)\n- [Errors and Warnings](#error)\n- [Logging](#logging)\n\nSecurity\n--------\n\nA data source can operate in one of two access modes as follows:\n\n- In\n restricted access mode, which is the default, a data source serves only\n those requests that originate from the same domain as that in which the\n data source is located. Restricted mode prevents [cross-site\n request forgery](http://en.wikipedia.org/wiki/Cross-site_request_forgery) (XSRF) attacks and so is more secure than unrestricted\n access mode. Because the data source library provides an interface for\n returning data only, and not for changing state or data on the server side,\n only XSRF attacks\n that attempt to steal data are possible. To\n make your data source secure against attempts to steal data, restricted\n mode must be used in conjunction with cookie-based authentication.\n The way that you authenticate users depends on your environment and implementation.\n\n- In unrestricted access mode, a data source serves all requests\n regardless of their origin. A data source that runs in unrestricted mode\n can be protected by cookie-based authentication, but note that\n the data source will be vulnerable to\n XSRF attacks. Use unrestricted mode if visualizations on web pages outside the data source's\n domain need to access the data source, or if the data is in the public\n domain and so does not need to be protected.\n\nA visualization request can specify a response\nformat of JSON, CSV, or HTML. The response format determines the format\nin which a data source returns a data table. Because CSV and HTML formats\nare not vulnerable to XSRF attacks, these can be accessed from other domains,\neven in restricted mode.\n\nTo specify unrestricted mode, override `isRestrictedAccessMode()` as\nfollows: \n\n```transact-sql\n @Override\n protected boolean isRestrictedAccessMode() {\n return false;\n }\n```\n\nFor simplicity, all the examples provided with the library run in unrestricted\naccess mode.\n\nErrors and Warnings\n-------------------\n\nWhen it is not possible, or desirable, to return a valid data table, the\nlibrary throws a `DataSourceException`. For example if\nthe user cannot be authenticated. The library throws these exceptions\nwhen errors prevent it from creating a data table. You may want to throw\nexceptions in situations unique to your data source. If so,\ncreate your own error exception types by inheriting from the `DataSourceException`\nclass. You can also throw the `DataSourceException` class\ndirectly.\n\nThe `DataSourceException` class\nis located in the `base` package, it takes the following parameters: \n\n- `ReasonType` \n This parameter is mandatory. Available reason types are defined in the `ReasonType` enum. If none of the available reason types are suitable, you can use `Other` or `Internal`. \n- `MessageToUser` \n This parameter defines the text of the error message. In most cases, it is displayed to the user as a tooltip, so it is important not to include technical or confidential information.\n\nYou can use the set of helper functions\nin `datasource.DataSourceHelper` to handle\nerrors. In this case call two functions both with same name of `setErrorServletResponse` to\ntake a `DataSourceException` and set an error on the data\nservlet response. One of these functions takes a data source request, the\nother takes an `HttpServlet request` and is used in cases\nwhere there is a failure to create a `DataSourceRequest`. An\nexample implementation is provided in [Defining Capabilities and the Flow of Events](/chart/interactive/docs/dev/dsl_httpservlet).\n\nIf it is not possible to return a data table, the library returns an\nerror. If it is possible to return a data table, but there is a problem\nto report, the library returns a warning together with the data table.\nFor example, the library\ncreates a warning in the following situations:\n\n- if a querying visualization provides a `LIMIT` that results in truncated data.\n- if a querying visualization requests an invalid formatting pattern in a `FORMAT` clause.\n\nTo add your own warning,\ncreate an instance of `base.Warning` and add it to your\ndata table using the `addWarning()` method.\n\nLogging\n-------\n\nThe library uses Jakarta commons logging. Jakarta commons logging can\nbe used with most common logging systems that you might already have in\nplace. You might need to write an adapter if your logging system is non-standard.\nFor more details, see the [Jakarta\ncommons logging home page](http://commons.apache.org/logging/).\n\nWhen an exception is thrown information is sent to the log. The way\nthat you access the log depends on the logging system you use."]]
