Changing BIRT viewer to use POST instead of GET request to pass parameters through encrypted SSL

dsampson · March 3, 2016

Similar to this theme:
<a data-ipb='nomediaparse' href='https://bugs.eclipse.org/bugs/show_bug.cgi?id=475144'>https://bugs.eclipse.org/bugs/show_bug.cgi?id=475144</a>
 
Is there a way to pass all parameters through the BIRT viewer (say 3.7 or 4.4.2) as a POST request instead of GET?
 
This way, the parameters can be encrypted through SSL as POST, vs unencrypted in the URL of a GET request.

Security is the concern.
 
-David

Clement Wong · March 3, 2016

Yes, you can pass parameters via POST.
 
Here is an example with the out of the box example report, test.rptdesign, using the /frameset servlet.
 
Via GET
<pre class="_prettyXprint">
http://localhost:8080/birt/frameset?__report=test.rptdesign&sample=Hello+GET</pre>
Via POST
<pre class="_prettyXprint">
<HTML>
<BODY>
<SCRIPT>
function post(path, params, method) {
 method = method || "post"; // Set method to post by default if not specified.

 debugger;
 // The rest of this code assumes you are not using a library.
 // It can be made less wordy if you use one.
 var form = document.createElement("form");
 form.setAttribute("method", method);
 form.setAttribute("action", path);

 for(var key in params) {
 if(params.hasOwnProperty(key)) {
 var hiddenField = document.createElement("input");
 hiddenField.setAttribute("type", "hidden");
 hiddenField.setAttribute("name", key);
 hiddenField.setAttribute("value", params[key]);

 form.appendChild(hiddenField);
 }
 }
 document.body.appendChild(form);
 form.submit();
}

post('http://localhost:8080/birt/frameset?__report=test.rptdesign', {sample: 'Hello POST'});

</SCRIPT>
</BODY>
</HTML></pre>

dsampson · March 3, 2016

Thank you, that was helpful.
 
One motivation for this is that the Print capability of the BIRT server runtime viewer passes parameters with a GET request, and it would be nice to see it as a POST so the parameters can be protected by the SSL connection (at least what I can see in 3.7 and 4.4.2 runtimes).

dsampson · March 10, 2016

We already use the post method like you mentioned, but the URL is also showing my hidden parameter contents when clicking print function. Do you have any other suggestions to look at?

dsampson · March 10, 2016

<div>Is there any way to hide (not expose) the parameter after clicking the print function?</div>
<div>Rather than print, others can work as well for POST method with hidden parameters. The goal is to pass credentials, but to do it via a POST, and not to have it be part of the request.</div>

dsampson · March 10, 2016

Sorry, I was having a conversation with a colleague and wanted to make sure I clarified the situation we're trying to understand, please bear with me: 
We put these credential parameters in the body of the POST, but the "print" function is different than the other buttons, it creates a new tab and turns to use "GET", that is out of our control, and thus the parameters (that in this case have credentials) are appearing which we wish to hide. 
Other buttons of BIRT viewer do not need to open a new tab automatically, so the "POST" works as well.
 
Is it possible to indicate this as a defect with BIRT runtime? It really should use a POST request like the other buttons to keep all parameters being passed securely.

Clement Wong · March 10, 2016

The BIRT Viewer included with OS BIRT is an sample / example application.
 
<a data-ipb='nomediaparse' href='http://developer.actuate.com/deployment-center/deployment-guides/'>http://developer.actuate.com/deployment-center/deployment-guides/</a>
 
The BIRT Runtime download includes the BIRT Engine, a BIRT Sample Viewer WAR file, and an exploded version of the Sample Viewer WAR. The BIRT Engine is a set of Java APIs that can be used to integrate BIRTâ€™s powerful capabilities into your application. The Sample Viewer is a deployable WAR file that can be used to run and view BIRT designs via URL in a browser. The viewer also includes a tag library that can be used to embed the viewer or parameter page into JSP pages. This product guide will discuss everything from deploying the Sample Viewer to Tomcat to programming with the Engine APIs.
 
<a data-ipb='nomediaparse' href='http://www.eclipse.org/birt/documentation/integrating/viewer-usage.php'>http://www.eclipse.org/birt/documentation/integrating/viewer-usage.php</a>
 
The Example Viewer can ...
The Example Viewer also ...
 
It's Open Source and can be modified. The Viewer code is available from GitHub ( I recently posted how to build the BIRT Project (@ <a data-ipb='nomediaparse' href='http://developer.actuate.com/community/forum/index.php?/topic/38966-modifying-birt-engine/?p=142684).'>http://developer.actuate.com/community/forum/index.php?/topic/38966-modifying-birt-engine/?p=142684).</a>
 
You may also log an enhancement in Bugzilla (@ <a data-ipb='nomediaparse' href='https://bugs.eclipse.org/bugs/enter_bug.cgi?product=BIRT).'>https://bugs.eclipse.org/bugs/enter_bug.cgi?product=BIRT).</a>

birtprofi · November 15, 2016

Hi guys,
 
this topic is very usefull for me, because I have to change my reports. Still today I have passed the parameters in the URl String. This works perfect, but now I have a lot of data and the report breaks because the length of the URl is > 2 kb.
 
Now I will try to do this via post method. What I have to do, if I need multiple parameter. Could you help me please.
 
I will try with 3 parameters:
MaList = String
DatVon = Date
Data = Integer
 
Question 1:
How should the link look like, if will use the 3 parameters above.
<pre class="_prettyXprint">
post('http://localhost:8080/birt/frameset?__report=test.rptdesign', {MaList: 'Hello POST'}); ?</pre>
Question 2:
Where should I put the html section into the report? Should I use a text element at the beginning of the report? Or on the masterpage? Or could I use Script on initialize?
 
Could you give me an example on some BIRT test report? I didnÂ´t have any experience in html post method. Maybe you have also some other ideas, how I could send data values, they are > then 2kb. I use Version 3.7.2.
 
 
Thank you for your help and your efforts
 
best regards

Clement Wong · November 15, 2016

For question #1, it's JSON so it should look like:
<pre class="_prettyXprint _lang-">
post('http://localhost:8080/birt/frameset?__report=test.rptdesign', {MaList: 'Hello POST', DatVon: '2016-01-01', Data: 12345 });
</pre>
For question #2, the HTML isn't part of the report itself. The OP wanted to run the report from a separate HTML page. If you want it as part of the report, I suppose you can use a HTML report item at the top most item and use the <SCRIPT>...</SCRIPT> part of the code, but you may want to use a button or a link to trigger the Javascript.

birtprofi · November 16, 2016

thanks a lot for your help

Changing BIRT viewer to use POST instead of GET request to pass parameters through encrypted SSL

Comments

Categories