I have a database which is used for lookups by all users.

 

Users need to be able to open views in backend java / javascript, but should not have access via front end as some of the data is sensitive.

 

I know how to stop a user using the ?OpenView url command e.g. http://site/database/view?Openview - set the view property to launch an xpage.

I don't know how to stop a user using the ?ReadViewEntries url command e.g. http://site/database/view?ReadViewEntries to get an XML list of the view entries (which may contain sensitive data) other than removing any columns with sensitive data.

 

a) If I need to lookup to the sensitive data in backend I have a performance hit of retrieving the document from the viewentry rather than get a column value

b) If I need to lookup from the sensitive data then I have a security issue as the column cannot be removed.

 

So anyone know a way of preventing ?ReadViewEntries URL command ?