Security Options in WebForms Core 2

WebForms Core is a server-driven web technology that allows dynamic client-side actions to be executed directly from structured server responses (INI-style).

Because these commands can alter the DOM, load modules, or invoke JavaScript methods, the framework provides a configurable client-side security layer called Security section in WebFormsOptions.

This object defines what operations are allowed or blocked on the client.

By default, all security flags are disabled (set to false), giving developers full flexibility during local development.

However, for production environments, these settings should be carefully configured to prevent malicious code execution or unauthorized module loading.

Default Configuration

// Security

WebFormsOptions.DisableEval = false;

WebFormsOptions.DisableAppendJavaScriptTag = false;

WebFormsOptions.DisableLoadModule = false;

WebFormsOptions.UseLoadModulePathOnlyInAcceptedList = false;

WebFormsOptions.LoadModulePathOnlyInAcceptedList = ["math"];

WebFormsOptions.DisableCallMethod = false;

WebFormsOptions.UseCallMethodOnlyInAcceptedList = false;

WebFormsOptions.CallMethodOnlyInAcceptedList = ["alert"];

WebFormsOptions.DisableCallModuleMethod = false;

WebFormsOptions.UseCallModuleMethodOnlyInAcceptedList = false;

WebFormsOptions.CallModuleMethodOnlyInAcceptedList = ["confirm"];

WebFormsOptions.SendChecksum = false;

WebFormsOptions.ChecksumName = "checksum";

This default configuration is fully open, meaning:

• Any code sent from the server can be evaluated or executed.


• The client can dynamically load any JavaScript module or function.


• No checksum is sent or validated for message integrity.

This behavior is suitable only in development — not in production.

Recommended Configuration for Production

In production mode, you should restrict every dynamic behavior and explicitly whitelist the modules or functions that are safe to call:

// Security – Recommended for Production

WebFormsOptions.DisableEval = true;                     // Prevent eval() and dynamic code execution

WebFormsOptions.DisableAppendJavaScriptTag = true;      // Block dynamic <script> insertion



WebFormsOptions.DisableLoadModule = false;              // Allow module loading, but limit to whitelist

WebFormsOptions.UseLoadModulePathOnlyInAcceptedList = true;

WebFormsOptions.LoadModulePathOnlyInAcceptedList = ["ui-core", "math"]; // Safe modules only



WebFormsOptions.DisableCallMethod = false;              // Allow calling global functions

WebFormsOptions.UseCallMethodOnlyInAcceptedList = true;

WebFormsOptions.CallMethodOnlyInAcceptedList = ["showToast", "notifySuccess"]; // Whitelisted globals



WebFormsOptions.DisableCallModuleMethod = false;        // Allow calling module methods

WebFormsOptions.UseCallModuleMethodOnlyInAcceptedList = true;

WebFormsOptions.CallModuleMethodOnlyInAcceptedList = ["openDialog", "validateForm"];



WebFormsOptions.SendChecksum = true;                    // Verify server response integrity

WebFormsOptions.ChecksumName = "checksum";

Detailed Explanation of Options and Their Security Implications

Best Practices

1. 
   Enable all blocking flags in production — never allow eval() or <script> injection.


2. 
   Use whitelists for both modules and callable methods; they act as a built-in access control list.


3. 
   Use checksums or signatures to ensure responses were not tampered with in transit.


4. 
   Log and monitor attempts to run disallowed actions for early intrusion detection.


5. 
   Regularly audit and version-control your allowed module and method lists.

Summary

Security Options functions as a custom security policy for WebForms Core — effectively a programmable Content Security Policy (CSP).

Proper configuration ensures that:

• No arbitrary JavaScript is executed,


• Only trusted modules and functions can run,


• Responses are verified for integrity,


• And the client remains protected even if a server or proxy is partially compromised.

When used correctly, WebForms Core achieves the same level of runtime security as modern frameworks like Blazor Server, React, or Vue — while retaining the performance and simplicity of a lightweight web runtime.