How web security works under various conditions
Description
What to do when security is on, component level security is on, but Always enforce security at component level is not selected or is on.
Security is on, component level security is off
The initial page load is always controlled by the page security. Security is not checked for the initial load of any grid placed directly on a page. A user who can not view the page can never see the initial load of the grid. Any subsequent Ajax calls for that grid inherit the page security in most cases. There are exceptions in unusual circumstances when the page is located in a sub-directory. In those conditions, any Ajax call for the grid will be blocked as the page security can't be determined.
Any grid opened on a virtual page such as in a TabbedUI, from a row expander, or in a div or window has no security applied. Reports called by an Ajax call have no security
Security is on, component level security is on, but Always enforce security at component level is not selected.
Security for grids placed directly on a page is exactly the same as in the first condition. The initial page load and component rendering is controlled by the page security. Security is not checked for the initial load of any grid placed directly on a page. Any subsequent Ajax calls for that grid inherit the page security in most cases.
Any grid opened on a virtual page such as in a TabbedUI, from a row expander, or in a div or window now has component security applied. Reports called by an Ajax call must be explicitly allowed.
Security is on, component level security is on, Always enforce security at component level is on.
The initial page load is still always controlled by the page security. Security is not checked for the initial load of any grid placed directly on a page. Any subsequent Ajax calls to refresh the page, sort etc are now controlled by the component security permissions. They no longer inherit the page security. A component on a page must have the same security as the page. Any grid opened on a virtual page such as in a TabbedUI or from a row expander has component security applied. Reports called by an Ajax call must be explicitly allowed.
The third configuration has the best security, but does have some negatives. A component can only be placed on pages with the same security. In some applications, it is desirable to use the same component in multiple pages. if those pages have different security permissions, the same component can now be used in each case and multiple copies (possibly exact duplicates) will have to be built. Adding component level security means both page and component security must be assigned and managed. In a large project, this can be time consuming and errors from mismatched permissions are possible.
See Also