frevvoblog

Why do form rules run on the server and not in the browser?

One of our partners asked this question the other day: “I had a customer demo and they asked me if form rules are server side JS or Client Side. I vaguely remember it to be Server side ? Is that correct? Are there any pro’s/con’s?”

The answer, as of now, is that they run server-side.

The main pros are:

• Browser independence. We found it impossible to get these to run reliably in so many versions of so many browsers, especially IE. A bug in your rule (e.g. an infinite loop) will crash the browser and in some cases will require a Windows reboot. On the server, these run in separate threads with lower priority and timeouts so it will not crash the frevvo server.
• The ability for the rule to do server-side things like http:get () to a database connector, invoke a REST service etc. These often reside behind the firewall and are not accessible to the browser.
• The rules are not exposed to the browser at all so any sensitive information in the rule (e.g. a password) won’t leave the server. However, we do not recommend putting any sensitive information in a rule.
• Rules can use information like the currently authenticated subject user id, name, email etc. though technically it would be possible to make this available on the browser if required. However, providing this information in the browser is a potential security hole.
• Rules can also modify a control – in theory, this can cause large-scale changes to the form’s valid state. Think of an optional XML complex type that has a deeply nested data structure inside it with some required and some optional elements. If any element has a value, all the other required elements become required. It’s much easier and efficient to analyze the form on the server although, technically, this is also possible in the browser. It can be extremely slow for large forms, especially in IE or if someone is running on a slower machine.

The main cons are:

• It makes offline use very difficult to implement. We are working on this. It’s not going to be in the next release (v5.1) but it is on the radar especially for tablets.
• Potential for performance bottlenecks. However, this is rare since rules are not compute intensive typically. We think the benefits outweigh the drawbacks here.

We’re working on a rule validator and a rule console to make it easier for customers to validate their script and easily view/fix any runtime errors while testing. More on this coming up.

Pixel Perfect and Digital Signatures Webinar

Did you have a chance to attend our PDF and Wet Signatures Webinar ? If not or if you want to watch it again you can go here.

Our session on September 19th saw an attendance that surpassed our expectations and it was quite interactive with lots of questions. I think it is a good idea to discuss the most common questions from the audience and here they are:

Do I need a paid version of Adobe Reader to create the mappings ?

No. Adobe reader, mac preview, pdfescape.com are all known to work well for filling out the AcroForm during the mapping stage.

How can I create fillable PDFs ?

The PDFs used in the Webinar were downloaded from the IRS website with fields already fillable. You can use commercially available PDF authoring tools to produce your own AcroForms.

Are PDF repeating elements supported ? 

Yes, they are. Each repeating frevvo field is uniquely identified with an index and with the mapper you can map to the corresponding PDF repeat field.

In the Webinar you can clearly hear me saying that PDFs don’t have repeating elements. Well, maybe its good to clarify that statement before my opponents have a chance to use it during my eventual presidential bid. It is a matter of semantics.

Repeats in frevvo allow for the number of repeating elements to be defined at run time. You click the plus sign, a new element shows up, click the minus and it is gone. PDFs have repeating elements but they are statically defined and, as I said, we have it covered.

What I meant to say was that PDFs don’t have dynamic repeating elements like frevvo does.

What is the data format of  the wet signature ? 

It is a PNG.

Is it possible to conditionally generate some forms and not others ? 

Yes, using pre-conditions you can define which PDFs will be created based on form data.

Is it possible for the frevvo digital signature security to somehow be passed along to the PDF signature security?

frevvo does not support the setting of digital signatures on PDF AcroForms. Also, frevvo “flattens out” generated PDFs and while the data is maintained we actually remove the fillable fields.  This is not a guarantee of authenticity, but is probably sufficient for a wide range of cases.

Would you like to add to the list ? Comment ? Please do.