FWD » Core Development » Runtime Infrastructure

Although our exported APIs in the DAP do have security checking for access purposes, in practice I think we may be exposing too much in the use of our RemoteObject approach to export services by default in FWD. In the standard configuration (usually inherited from one of the Hotel templates), I think all users (in the default bogus FWD account) can access everything that is exported.

We need to:

• review the state of security for all of our exported services
• determine if any security improvements/new features are needed
• determine what configuration changes are needed to better lock down the default configuration
• make a list of any other security related issues found

Please check all external API mechanisms (appserver replacement, webspeed/web handler, REST, SOAP and the embedded driver up-calls) to identify any security issues. One example is whether simple incrementing handle IDs can be exploited via these APIs (see #5035-19 and the following discussion).