0

I have two questions :

1- Does the MobileFirst ver 7.1.0 provides encrypt functionality on the client side and decryption on the server side?

2- I need to pass username/pswd to the database through an adapter call. From client when I call adapter and pass these credentials it goes as a query string. How can I hide these while send it to server-side adapter?

MichealSmith
  • 183
  • 1
  • 2
  • 9

1 Answers1

0

  1. Does every mobile user have his/her own username password for the database? If so this is not ideal design. The database credentials must be held in the adapter's xml and the user must be authenticated to MobileFirst using security tests and login & authentication modules.

  2. If you still go by your original design, you can use Java adapters to accept credentials from the user through the payload of the call rather than query parameters. See https://www.ibm.com/support/knowledgecenter/SSHS8R_7.1.0/com.ibm.worklight.dev.doc/devref/t_impl_java_adapter_JAXRS.html

Having done this, make all your calls over HTTPS for the traffic to be encrypted during transit.

Srik
  • 7,907
  • 2
  • 20
  • 29
  • Thanks Srik, database credentials are held in the adapter's xml but I have some other data which need to be encrypted on a client and decrypted on server side e.g. credit card number. – MichealSmith Feb 15 '19 at 05:24
  • Option 2 is your way to go. Write a Java adapter and send the payload over HTTPS – Srik Feb 15 '19 at 06:05
  • Thanks Srik, This is new to me so want to make sure that this payload would be encrypted? do we have any sample given by IBM. Thanks – MichealSmith Feb 15 '19 at 07:21