Re: IBM i authentication and RESTful web service design

Nathan,

That's the gist, yes. 

A utility might work. But what technologies would the utility use? 

And what about cases where we want to perform some complex business logic in generating the JSON response? I really hate working with beastly SQL statements. I find them harder to understand and harder to debug than other programming languages. 

And what if we want to make use of other IBM i data resources such as data areas, data queues, spooled files, or IFS files?

Thanks,
Kelly


-----Original Message-----
From: WEB400 [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
Sent: Tuesday, May 19, 2015 8:55 AM
To: Web Enabling the IBM i (AS/400 and iSeries)
Subject: Re: [WEB400] IBM i authentication and RESTful web service design

>
> I just don't know enough about SPA development patterns to know what 
> might, or might not, be good ways of dealing with these issues.


It appears to me that you have settled on an architecture where the SPA consists of STATIC HTML, CSS, JavaScript; a yet-to-be-defined PROTOCOL where yet-to-be-defined JSON MESSAGES are exchanged with IBM i web services.

It appears to me that the role of the web services is to perform DB I/O, including reads, writes, updates, deletes, outputs of SQL result sets, and possibly other SQL operations.

If that is the case, then I don't see much of a role for COBOL programs. I would suggest just having a UTILITY perform DB I/O for SPA clients, via a messaging protocol, where messages are authorized and validated, which protects against SQL injection from browsers, and ensures that only certain users and user groups are authorized to the DB resources requested.

The UTILITY should just perform DB I/O and SQL operations against "requested" tables and SQL views, and return results, including error messages.

Is that right?
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list To post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at http://archive.midrange.com/web400.