MSAMM
Back to course

Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what

Secrets do not go in an application

Lesson 115 of 176 · 3 min

Keys, tokens and passwords are READABLE BY ANYONE WHO OPENS THE SOURCE. WHERE THEY GO INSTEAD. This is the shortest rule in the module and the one with the largest consequence when it is broken. ANYTHING IN YOUR APPLICATION IS DOWNLOADED TO THE BROWSER, WHICH MEANS IT IS READABLE. A key in a JavaScript function, in a variable's default value, in a header configured on a connection, in a comment — all of it arrives at the user's machine, and none of it is obscured by being inside a visual tool. AND A KEY THAT REACHES ONE USER HAS REACHED EVERY USER. It is not an exposure to the curious person who looked; it is an exposure to everybody who has ever loaded the page, retroactively and permanently, and there is no way to know who has a copy. WHAT MAKES THIS WORSE THAN THE OTHER LESSONS IS THAT THE…

The full lesson is part of the course

The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.

See the course and enrol9 free lessons

Get the free lessons by email

We will email you a link to every free lesson in this course. No account needed, and one message only.

In this module: Module 11 · Security: who sees what

  1. 1Where the trust boundary is
  2. 2Filtering in the UI is not securityFree preview
  3. 3Hiding a field sends it anyway
  4. 4Filter at the source
  5. 5Identity propagation, properly
  6. 6Roles inside your application
  7. 7Securing business object endpoints
  8. 8Secrets do not go in an application
  9. 9What ends up in a log or a URL
  10. 10What breaks: four security findings
  11. 11Lab briefing · Attack your own application