RE: Web-to-i Communications questions -- MIDRANGE-L

Ideally, if you are using authentication, you could create a CGI program to actually stream the PDF file to the browser. This way, the PDF does not have to reside in a publicly addressable folder. This CGI program could accept a parameter to identify the PDF requested (account number, invoice number, whatever). Since the webserver uses authentication, the program would just check the user profile and validate that the user has access to the requested PDF.

Doing this would allow you to pass URL's in your web service response and also the ability to embed such URL's elsewhere (maybe in an email).

Brian May
IBM i Modernization Specialist
Profound Logic Software
http://www.profoundlogic.com
937-439-7925 Phone
877-224-7768 Toll Free

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Monday, January 20, 2014 3:15 PM
To: Midrange Systems Technical Discussion
Subject: Re: Web-to-i Communications questions

Brad,

If you sent a link to the PDF's doesn't that mean that whatever folder the PDFs are stored in has to be accessable to the web site? That being the case, couldn't a authorised user play with the URL and pull up somebody else's PDF?

I suppose if you stored the PDFs in a structure that included subfolders for every customer, you could lock down that sub folder to the individual customer...

Charles

On Mon, Jan 20, 2014 at 3:25 PM, Bradley Stone <bvstone@xxxxxxxxx> wrote:

I would get all the specs first then. If it's all internal in your
LAN, it shouldn't be an issue.

If it's external you can still use SSL (and authentication if you want
more security). Yes, you would need to map an external IP to your
internal machine. Just like you would with any server.

You can set up the server on the i to run on it's own internal IP with
it's own server instance and config file and own ports and authority.
If set up right, any old hacker shouldn't be able to access anything
except that which you give authority to.

Don't think of the i as anything different than any other server
(except it's better! haha).

To answer your question easily and honestly, yes, it can be done.
Yes, you will hear worst case scenario security issues what ifs (that apply to ANY
server you have running, even PCs). If it's that big of a problem, ask
about the possibility to get a separate machine or partition to run
this stuff on (although I don't see a big reason for that.. then you
get into data replication issues which can be bigger headaches.)...

For the PDFs, sending a link to them isn't a big deal, especially if
it's over SSL. You would probably want to protect the PDFs with
passwords as well as access to them should use authentication
(homegrown or standard
Apache) as well as SSL.

I'd worry more about the PDF once it's open on the client's machine
then just passing a URL for it. :) Digital copies are too easy to make.

If you know what you're doing, it can be secure. If you wing it, you
open yourself up. I've been doing this for years and ran into many scenarios.
Worst case are just that. And they apply to everything. Do it right and
it works great. :)

Brad
www.bvstools.com

On Mon, Jan 20, 2014 at 12:37 PM, Koester, Michael
<mkoester@xxxxxxxxxxxxx>wrote:

It is not yet known if the web server will be inside our firewall,
(my guess is it may not be), and bank routing and account numbers
seem sensitive to me. And I don't think the business would like
their customers' phone bill images to be available to any old hacker.
Can a web service be set up to be private? How?
-- Michael

From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
bounces@xxxxxxxxxxxx] On Behalf Of James H. H. Lampert
Sent: Monday, January 20, 2014 1:25 PM
To: Midrange Systems Technical Discussion
Subject: Re: Web-to-i Communications questions

On 1/20/14 10:07 AM, Koester, Michael wrote:

Is there something I should know about how to "actively keep it

private"?

It would not be intentionally published.

Well, the whole issue I was raising (and my apologies if it was
already dealt with earlier in the thread) was whether it would be
accessible from outside your firewall, and under what
circumstances, and how sensitive the information is.

--
JHHL

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.