Re: HTTP and Web server configuration and security.

Rob,

Basically the API  is behind a firewall.  No  external users can access. 
So if you want all INTERNAL users to access, then you are fine. 

If there is sensitive information being passed from/to API, probably good 
idea to go over a secure (SSL)  connection. 

By end of 2020, you  will have additional security features,  highlighted 
by assigning users to roles and protecting APIs via roles, so that users 
with required roles will only be authorized to the API.



"WEB400" <[email protected]> wrote on 12/02/2020 07:18:13 
AM:

> From: Robert Rogerson <[email protected]>
> To: "Web Enabling the IBM i (AS/400 and iSeries)" 
<[email protected]>
> Date: 12/02/2020 07:18 AM
> Subject: [EXTERNAL] [WEB400] HTTP and Web server configuration and 
security.
> Sent by: "WEB400" <[email protected]>
> 
> I was able to create an HTTP and web services servers from the wizard. I
> then created an api.  I was able to test it with Postman and everything
> checked out.
> 
> The next thing I'm unsure of is security.
> 
> I created a new user with *USER authority and no special authority  I 
also
> changed the initial menu to signoff.
> I redeployed the web service speciying this user profile on User ID for
> this service.
> I retested with Postman and it still works.
> 
> I ended my vpn.  The api now timed out in Postman.
> 
> So my question is, if the api is only ever called from behind the vpn is
> there still a big hole I'm missing?
> Is SSL required if behind a vpn?
> 
> 


-- 
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.