Re: IBM i authentication and RESTful web service design

>
> I just don't know enough about SPA development patterns to know what
> might, or might not, be good ways of dealing with these issues.


It appears to me that you have settled on an architecture where the SPA
consists of STATIC HTML, CSS, JavaScript; a yet-to-be-defined PROTOCOL
where yet-to-be-defined JSON MESSAGES are exchanged with IBM i web services.

It appears to me that the role of the web services is to perform DB I/O,
including reads, writes, updates, deletes, outputs of SQL result sets, and
possibly other SQL operations.

If that is the case, then I don't see much of a role for COBOL programs. I
would suggest just having a UTILITY perform DB I/O for SPA clients, via a
messaging protocol, where messages are authorized and validated, which
protects against SQL injection from browsers, and ensures that only certain
users and user groups are authorized to the DB resources requested.

The UTILITY should just perform DB I/O and SQL operations against
"requested" tables and SQL views, and return results, including error
messages.

Is that right?