Registering External Applications in WebCenter Portal Applications

26-2 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter

26.2 Performing Required Manual Configurations to Enable REST

The WebCenter REST services are not enabled by default. To enable the REST services to work, you must perform a manual configuration procedure. This procedure prepares the credential store to handle encrypted security tokens. For detailed information on the required configuration steps see Before Using REST: Perform This Required Manual Configuration in the Oracle Fusion Middleware Developers Guide for Oracle WebCenter.

26.3 Understanding Security Tokens

A user-scoped security token is embedded in the href and template attributes of every REST service URI. The token is both generated and validated by the server. The purpose of the security token is to prevent Cross-Site Request Forgery CSRF attacks. For example: link template=opaque-template-urime?startIndex={startIndex} itemsPerPage={itemsPerPage}token=generated-token resourceType=urn:oracle:webcenter:messageBoard href=opaque-urime?token=generated-token capabilities=urn:oracle:webcenter:read Security tokens are based on the authenticated user’s name. They do not expire, making it possible to both cache and bookmark the URIs. Security tokens are also salted, a cryptographic technique of adding extra characters to a string before encrypting it. Because of salting, if a security token is compromised, you will not have to change the user’s user name across the entire system to address the problem. This technique prevents cases where a user name is compromised and you don’t want to have to change the user name system wide to fix the problem. For more information on security tokens, see Security Considerations for WebCenter REST APIs in the Oracle Fusion Middleware Developers Guide for Oracle WebCenter.

26.4 Configuring a Proxy Server

This section explains how to set up a simple, response-rewriting reverse HTTP proxy on an Apache server. A proxy server is typically employed to avoid cross-domain request problems associated with making XMLHttpRequest XHR calls from a browser client. These calls are typically associated with the Ajax development technique for creating rich, interactive client-side interfaces. REST APIs are typically used within this kind of client-side development scenario. Note: The security token is not used for authentication or identity propagation.