Oracle Visual Builder: Applications That Outlive Their First Release · Module 5 · Data: business objects and external services
The endpoints your objects expose
Lesson 50 of 176 · 3 min
EVERY BUSINESS OBJECT IS A REST SERVICE. Who can call it, and THE CHECK THAT IT IS NOT MORE THAN YOU INTENDED. This is the lesson in the module that is a security lesson, and the reason is one sentence: creating a business object creates a public endpoint whether you wanted one or not. THE ENDPOINT EXISTS FROM THE MOMENT THE OBJECT DOES, AND NOTHING ABOUT YOUR PAGES CONSTRAINS IT. Your page might only ever read three fields of the rows belonging to one customer. The endpoint returns every field of every row to anybody permitted to call it — and "permitted" is decided by the object's own configuration, not by what your pages happen to do. WHICH IS WHY THE DEFAULT IS THE THING TO CHECK. An object left as created is typically readable by any authenticated user of the application, and "authenticated" is a much larger group than…
The full lesson is part of the course
The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.
In this module: Module 5 · Data: business objects and external services
- 1Business objects: your own database
- 2When to keep data here, and when not to
- 3Designing a business object
- 4Object rules and triggers
- 5Importing and exporting data
- 6The endpoints your objects expose
- 7External services: the other half
- 8Reference data and lookups
- 9What breaks: three data failures
- 10Lab briefing · Two sources, one screen