OpenEdge Development: Mobile Applications - Product ...

Chapter 5: Deploying Mobile Applications
Defining user roles for a Web application
User roles allow you to define access controls for the Mobile services and resources of
a Mobile Web application so that only users that have a given assigned role can access
a given resource. OpenEdge provides a built-in set of predefined roles or you can
define your own user roles for a Web application. For more information, see the
sections on adding users, and user roles and privileges, for REST applications in
OpenEdge Application Server: Administration.
Setting access controls based on user roles
The tools for setting access controls on a Web application's resources are provided
entirely using the Spring Security framework installed with OpenEdge. For more
information on using the Spring Security framework to apply access controls, see the
Spring Security documentation at
http://static.springsource.org/spring-security/site/reference.html.
Cross-origin resource sharing (CORS)
Cross-origin resource sharing (CORS) is a W3C group standard that allows a Mobile
App's JavaScript to access Web application resources in a DNS domain different from
the one the current HTTP page and JavaScript were loaded from. Such “cross-domain”
requests are otherwise forbidden by Web browser’s JavaScript engine. The CORS
standard defines a way in which a Mobile App's JavaScript can ask the Web application
if it can make the cross-origin request, and the Web application's configuration can
determine if the cross-domain request will be granted. The W3C CORS standard works
by adding new HTTP headers that allow servers to control resource access to
permitted origin domains.
CORS support is enabled in Mobile Web applications and its defaults are configured to
grant access to all Mobile services from any generic HTTP requests (made by a non
JavaScript client) and any JavaScript engine from any DNS domain. This means that
a Mobile App can load a Web page from one DNS domain and perform Mobile
operations on any Mobile service's resources residing in another DNS domain. CORS
support is extended to all modern mobile devices and Web browsers. Before using
devices and browsers with a CORS-enabled Mobile application, ensure that they
support the CORS standard. For more information on the CORS standard, see the
documentation at http://www.w3.org/TR/cors/.
You might need to configure CORS support for a Mobile Web application specific to a
production site's requirements. You can do this in exactly the same way as for a REST
Web application. OpenEdge supports CORS configuration using the Spring Security
framework embedded in each Mobile and REST Web application. For more information
on configuring this CORS support, see the sections on managing security for REST
applications in OpenEdge Application Server: Administration.
144 OpenEdge ® Development: Mobile Applications