Rest Web Services Security - best practices

[Paul_Lefebvre]

@255328:@Carl Clarke

When I do this in .NET land I have to create versioned data models and map from database to model to return the JSON of the model or map from model to database for a PUT/POST. Is there a neat way to do this in Luna or something that I will need to add.

You’ll have to handle this yourself.

[DerkJ]

[quote=253890:@James Sentman]I’m not sure I understand why you need encryption on top of an SSL connection? The SSL connection is negotiated first, before any other data is sent back and forth. Once you have an SSL connection then any other tokens or user id/passwords that you send will already be encrypted so no further encryption should be necessary. It will just slow things down and add layers of complexity.

It’s also possible I totally misunderstood what you’re doing ;)[/quote]

If you do such, your information could be read captured and insecure.

[Tim_Hare]

How so?

[Aurelian_N]

@255284:@Paul Lefebvre

Xojo.Net.HttpSocket

Well it just states in the docs that it is not compatible with the webapps “HTTPSocket is not yet compatible with Web Apps.” or it is just outdated ?

I hope that in the coming xojo version all will be working and the recent bug fixes will solve this issue as well.

Thanks

[Carl_Clarke]

@255422:@Aurelian Negrea

Well it just states in the docs that it is not compatible with the webapps “HTTPSocket is not yet compatible with Web Apps.” or it is just outdated ?

Wouldn’t you just be using the HttpSocket in your client application rather than in the Web App?

[Michel_Bujardet]

@255422:@Aurelian Negrea

Well it just states in the docs that it is not compatible with the webapps “HTTPSocket is not yet compatible with Web Apps.” or it is just outdated ?

True, the new framework Xojo.Net.HTTPSocket is not yet implemented in Web apps.

But unless you specifically NEED the new framework and HTTP 1.1 for instance, classic HTTPSocket has been working like clockwork in Xojo Web for years. http://documentation.xojo.com/index.php/HTTPSocket

[DerkJ]

@255398:@Tim Hare

How so?

Drown Attack

SSL/TLS on itself is pretty secure but even then it’s possible to view your information. That’s why hashing should always be used for passwords. Never give a possible way to change sensitive information without knowing you did all to protect it.

[Dirk_Cleenwerck]

I’ve done some work to make Luna work with Postgresql.
Since I haven’t figured out how to be a contributor to the github project, here is my version to play around with.
https://www.dropbox.com/s/1w52bceqz1thbdt/lunapg.zip?dl=0

Disclaimer: It works on my computer

I have a week of holidays coming up, so I won’t be able to work on it for the next week

[Tim_Dietrich]

@Carl Clarke Regarding versioning… Unfortunately, there isn’t an easy way for Luna to handle this for you automatically. Providing backwards compatibility for an API can get tricky. The best way to handle it will depend on your situation.

In your example, where what had been a full name is now split into distinct first and last name columns, one option is to pull the data from a view, where the actual underlying columns are First Name and Last Name, but the view concatenates them and returns them as “Full Name.”

Another option is to manipulate the results in Luna / Xojo itself, before returning them to the client. So the database would return the First and Last Name columns to Luna, and Luna would combine them into a Full Name attribute as part of the response.

Also, regarding Paw… I haven’t used this myself, but I’ve heard very good things about it: http://blog.clearbit.com/introducing-the-run-in-postman-button/

I hope this helps!

[Dirk_Cleenwerck]

I just put an update up to my changes to Luna so that you have the option of working with PostgreSQL.
I removed a bug (in case of an error DatabaseConnection would still be used instead of pgDatabaseConnection to the errornumber from the database).
I also added a note explaining how to tell Luna to use PostgreSQL instead of MySQL and what you need to take into account when using Luna in combination with PostgreSQL instead of MySQL.

https://www.dropbox.com/s/1w52bceqz1thbdt/lunapg.zip?dl=0

I also forked the project in GitHub and created a pull request, so hopefully the changes will make it to the main project.
https://github.com/eurog33k/luna

Feedback is welcome.

[Tim_Dietrich]

Dirk –

I’ve just merged your Postgresql-related changes to the project on GitHub.

Thanks for contributing to Luna.

– Tim

[Dirk_Cleenwerck]

I’m sure it could do with more testing. The testing on my end was on Mac OS X 10.10 and Windows 7. It seemed to work for me on my machine and that’s about it. If anyone wants to play with it, please do. I think Tim has a great project. REST API’s can be really helpful when you want to have cross platform software. You put your logic behind the REST API and then call that from your other apps. This way you can have your logic in Xojo and your client UI in whatever you need (making Android a UI target).

[Tim_Dietrich]

@Dirk Cleenwerck: Any chance you’ll be attending XDC 2016? If so, I’d love to meet you in person.

I’m giving a session on APIs, and will be demoing Luna as part of it. And while I won’t be able to demo the PostgreSQL support, I will be mentioning it, as well as your PostgreSQL-related contributions to the project.