[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Ftpapi] Hiding web service sign-on information



I am alittle confused also

Its not like this is running from Starbucks over a public wifi - are you
worried about an "internal" user at the customer site from finding and
looking at the source code to view the credentials ?  if so, why not just
remove the source ?  

Or are their internal users sniffing the network ?  Who are these people ?

Or am I missing this completely 




-----Original Message-----
From: ftpapi-bounces@xxxxxxxxxxxxxxxxxxxxxx
[mailto:ftpapi-bounces@xxxxxxxxxxxxxxxxxxxxxx] On Behalf Of Jon Paris
Sent: Thursday, September 03, 2020 11:51 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: HTTPAPI and FTPAPI Projects <ftpapi@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [Ftpapi] Hiding web service sign-on information

Why not simply encrypt the credentials?  Use JWTs ... or whatever. You can
also tie the signon to a specific IP if you need to be that restrictive.

Am I missing something here?



> On Sep 3, 2020, at 11:37 AM, James H. H. Lampert
<jamesl@xxxxxxxxxxxxxxxxx> wrote:
> 
> Ladies and Gentlemen of the Midrange and HTTPAPI/FTPAPI Lists:
> 
> We have a situation in which we have AS/400 programs (created and running
on customer boxes), called from batch jobs, that access web services (which
we host), which require a sign-on. Access is via HTTPAPI.
> 
> The problem is protecting the web service sign-on information from the
prying eyes of potentially malicious users.
> 
> If we call a "factory" program or module that vends the information,
what's to stop anybody who can see the call in the source from writing their
own program to call the factory?
> 
> If we provide a "wrapper" that passes the information to the programs that
call the web services, what's to stop anybody who sees how the programs get
the information from the wrapper from plugging their own programs into the
wrapper?
> 
> Anybody know of any good ideas in this regard?
> 
> --
> JHHL
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To 
> subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives at 
> https://archive.midrange.com/midrange-l.
> 
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
> 
> Help support midrange.com by shopping at amazon.com with our affiliate 
> link: https://amazon.midrange.com

--
_______________________________________________
Ftpapi mailing list
Ftpapi@xxxxxxxxxxxxxxxxxxxxxx
http://scottklement.com/mailman/listinfo/ftpapi

-- 
_______________________________________________
Ftpapi mailing list
Ftpapi@xxxxxxxxxxxxxxxxxxxxxx
http://scottklement.com/mailman/listinfo/ftpapi