Trace: • Developer Documentation • Release notes • Join • JVx Code Snippets • Package Overview
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
jvx:security [2026/11/11 11:59] admin |
jvx:security [2026/11/11 12:27] (current) admin |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ~~Title: Security~~ | ~~Title: Security~~ | ||
| - | By default, care is already taken to ensure that server access is only possible with authentication. If this is not sufficient, additional security measures can be activated in JVx: | + | By default, care is already taken to ensure that object access is only possible with authentication. If this is not sufficient, additional security measures can be activated in JVx: |
| - | ==ServletServer== | + | =====ServletServer===== |
| The ''ServletServer'' is required for communication between a desktop client and the backend. You can completely disable the ''ServletServer'' if you do not use a desktop client or if you don't use ''HttpConnection'' directly. | The ''ServletServer'' is required for communication between a desktop client and the backend. You can completely disable the ''ServletServer'' if you do not use a desktop client or if you don't use ''HttpConnection'' directly. | ||
| Line 79: | Line 79: | ||
| Another option is to load your checker using the standard Java Service Loader. | Another option is to load your checker using the standard Java Service Loader. | ||
| - | ==REST Services== | + | =====REST Services===== |
| If you use [[jvx:common:util:rest|REST Services]] to enable access to application data via standard HTTP, such as: | If you use [[jvx:common:util:rest|REST Services]] to enable access to application data via standard HTTP, such as: | ||
| Line 151: | Line 151: | ||
| </file> | </file> | ||
| - | ==Life-cycle Objects== | + | =====Life-cycle Objects===== |
| Business logic is defined in [[jvx:server:lco:lifecycle|Life-cycle]] objects. Default security ensures that all public methods are callable. If you change a method to ''protected'' or ''private'', it is no longer callable, e.g.: | Business logic is defined in [[jvx:server:lco:lifecycle|Life-cycle]] objects. Default security ensures that all public methods are callable. If you change a method to ''protected'' or ''private'', it is no longer callable, e.g.: | ||
| Line 172: | Line 172: | ||
| </code> | </code> | ||
| - | Details on ''@Accessible'' and ''@NotAccessible'' can be found [[jvx:server:lco:objects_in_actions|here]]. | + | Details on ''@Accessible'' and ''@NotAccessible'' can be found [[jvx:server:lco:actions_in_objects|here]]. |
| - | ==Object-specific Calls== | + | =====Object-specific Calls===== |
| If you want to control specific accesses in your application, you can achieve this by implementing [[jvx:server:security:object_method_access|IObjectAccessController]]. This interface is checked every time a [[jvx:server:lco:lifecycle|Life-cycle Object]] is called. This allows fine-grained control at the instance level. | If you want to control specific accesses in your application, you can achieve this by implementing [[jvx:server:security:object_method_access|IObjectAccessController]]. This interface is checked every time a [[jvx:server:lco:lifecycle|Life-cycle Object]] is called. This allows fine-grained control at the instance level. | ||
| Line 180: | Line 180: | ||
| Access control for REST only works for REST calls, and access control for ''ServletServer'' only works when an ''HttpConnection'' is used. Using the [[jvx:server:security:object_method_access|IObjectAccessController]] works independently of this. | Access control for REST only works for REST calls, and access control for ''ServletServer'' only works when an ''HttpConnection'' is used. Using the [[jvx:server:security:object_method_access|IObjectAccessController]] works independently of this. | ||
| - | ==Environment-dependent Access== | + | =====Environment-dependent Access===== |
| If you work with Accessible and NotAccessible, you can also control access per environment, as described [[jvx:server:lco:accessible_notaccessible|here]]. | If you work with Accessible and NotAccessible, you can also control access per environment, as described [[jvx:server:lco:accessible_notaccessible|here]]. | ||
| - | ==Checklist== | + | =====Checklist===== |
| * Disable ''ServletServer'' or restrict calls | * Disable ''ServletServer'' or restrict calls | ||