Recently, according to the Test report submitted after our system test, the Jiangsu Provincial Software Park Evaluation Center needs to do some security repair and optimization processing. The following is a summary of the proposed suggestion based on the evaluation report. Since this system is designed more than a year, there is some shortcomings in some design (especially intermediate layers), in fact, it is difficult to perform full reconstruction in the short term, optimization is difficult. Therefore, some of the suggestions or objectives need to be gradually performed according to project progress and difficulty.
Returns the caller to the client after all the abnormal encapsulation of the intermediate layer, and the client is handled by the client to display the friendly prompt information or the necessary processing. To break down the current large WebService class into multiple business logical object classes, the client only creates the corresponding business logic WebService class when you need to use the relevant business logic, and release the created business logic when you turn off the relevant business sub-module. Objects, this reduces the memory usage of the client. Refer to the "WebService Efficiency Tips" intermediate layer Try to use the stored procedure to get DataSet and update it, do not use CommandBuilder to generate an update command. In the form of a multi-table form, you should simultaneously return all the tables you need in one method and establish the related associations and constraints for these tables. Use Microsoft Report Services to create a report to increase the user-defined flexibility of the report and the aesthetics, multi-performance, the report service supports the export feature of multiple format files. The overall parameter setting class of the system is redesigned, and the configuration of various parameter options in the system is unified, and the flexibility in system parameterization is improved. The operating manual is recommended to be re-written or organized by a special person. Writing the user manual by the developer does not compensate, and the style is difficult to unify, and the readability is not strong. Special business logic objects must be used to conduct special processes for concurrent conflicts. Because the system uses a single database, there is no need to cross the database transaction management, so transaction processing using ADO.NET can be copened, and it is recommended to use the REPEATABLE READ transaction isolation level to ensure changes to other users when they are adults. . Try to minimize the number of calls to the application server. In this premise, the specific problem is adjusted according to the specific problem. When performing a long operation of the response time, add some prompts such as "progress bar" to enhance the responsiveness of the system [Reference: "Enterprise Application Schematic Mode" Introduction 5]. Optimization of getSystime: The client is calculated by the client based on the current time and the server time difference, to reduce the number of acquisitions for server time, and see the appendix for the algorithm. Use digital signatures and symmetrical encryption to ensure communication security, please refer to the details of the program: "Safety: Encryption and Digital Signature"
Note: getSystime is a function of obtaining the current datetime of the server.
