Re: XML-RPC and Stand-alone Apps

Thanks for the link Ernst.  It looks like XINS would provide me with a small
web-services framework, but I'd still have to write another layer to talk
from the web-services layer back to my app since it's stand-alone.  This may
be ok, it's definitely an option I'm exploring... I'm just concerned about
overhead and response lag since my backend application will be talking to
clients synchronously.  I don't want them to wait forever for a response
because it's going through 3 layers of translation.

The security concern is with our security group actually, not me.  They
always question adding a  new web/app server in the environment, and I
question requiring an additional app server to support a middleware
service.  I don't want my web apps to have to jump through too many hoops to
access the resource.  If they can make requests directly to my apps, then
I'm removing a layer of complexity.

On 7/26/06, Ernst de Haan <[email protected]> wrote:
>
>   > I'm not sure this is even possible, however, I'll pose the
> > hypothetical. I have a stand-alone Java application. One of the
> > requirements is that I be able to support different types of inbound
> > communications to act upon the application. One of the communication
> > methods is XML-RPC. However, for security reasons, we'd rather
>
> To support multiple protocols, have a look at XINS, it supports
> XML-RPC, SOAP and POX-RPC (simple HTTP parameters in, XML out) and can
> be extended with new protocols:
> http://xins.org/
>
> > methods is XML-RPC. However, for security reasons, we'd rather
> > implement XML-RPC without a traditional Tomcat or other application
> > server container. We would like to receive XML-RPC requests straight
>
> > to the application and handle them natively. I'm not sure if there's
>
> Why do you consider this more secure? What are the main concerns,
> exactly? Is it with applications servers in general or specifically
> with Tomcat? Note that some application servers or runtime
> environments such as PHP have spent ages optimizing their security.
>
> If you write your own HTTP server application, you may be introducing
> security issues without knowing it.
>
> Other options including putting a secure layer in front. A very simple
> one would be Apache, which is by many people considered to be one of
> the most secure HTTP servers around.
>
> Hope this helps.
>
> Regards,
>
> Ernst
>
>  
>


[Non-text portions of this message have been removed]



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/xml-rpc/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/