How To Ensure That The Hibernate Version Number Stays Immutable In A Javascript Client?

I have a Rest backend with Java and Hibernate and im using Optimistic Locking with the version property. For concurrency control, this version property must go to the client and a

Solution 1:

Personally, I would rethink doing this, as I see little to no motivations for a client to do that and by definition you can NOT control what a client sends to your REST service.

However, if you really do have a business case, then one semi-solution is to make the version property a GUID. That way, you can only submit if you have the newest GUID, which client B would not have, and it makes the versioning case more complicated because you cannot just increment by 1 until the request succeeds.

However, even there you are not entirely safe, as client B could theoretically do a separate request to get the updated GUID from the resource and then resubmit the failed request with the updated GUID.

But since client B could have done an edit on the updated version to revert what client A did and add their own, this is essentially the same as doing that, and since they have authority to do that, we are back to asking ourselves why we are worrying about that case in the first place again.

Solution 2:

Use a constructor that hides the number behind a read-only getter:

varMyObject = function(version) {
    var _version = version;

    this.getVersion = function() { return _version; }
}

Or, use a getter and setter pair that allows for the variable to be set only once:

var MyObject = function() {
    varself = this;

    var _tripwire = false;

    var _value = null;

    self.setValue = function(val) {
        if (_tripwire==false)
            _tripwire = true;
        elsethrow"Value is read-only";

        _value = val;
    };

    self.getValue = function() {
        return val;
    }
};

JSFiddle

Depending on how you want it to fail, you could replace the throw statement with a return that silently eats the property set, but for API code, when the caller does something profoundly unsafe, it's better to die loudly and proudly.

Note that, if you prefer the property-style access method, you can also accomplish the same design pattern with property accessors:

functionsetOnceProp(o, name) {
    var _value = null;

    var _tripwire = false;

    Object.defineProperty(o, name, {
        get: function() { 
            return _value; 
        },
        set: function(newValue) { 
            if (_tripwire==false)
                _tripwire = true;
            elsethrow"Value is read-only";

            _value = newValue; 
        },
        enumerable: true  
    });    
}

var MyObject = function() {
    varself = this;

    setOnceProp(self, 'value');    
};

This does require that your clients are using relatively recent browsers.