Security of postbacks / button visibility

[Guest]

If I put a asp button on a page with a runat=server attribute and then
set it's visibility to FALSE, so that it doesn't display on the page,
but have a click event for the button in the code behind, is it
possible for someone to still write a javascript postback routine and
trigger the code behind's click event?

 

[Jesse Houwing]

Hello (e-mail address removed),

If I put a asp button on a page with a runat=server attribute and then
set it's visibility to FALSE, so that it doesn't display on the page,
but have a click event for the button in the code behind, is it
possible for someone to still write a javascript postback routine and
trigger the code behind's click event?

The security of these postbacks has been improved in ASP.NEt 2.0. Theoretically
it's possible though.