Re: Different approaches to expose RPG program outside of ibmi

Glad to provide a few without going deep into the weeds on a Friday afternoon.


1.
Basic HTTP Authentication sends usernames and passwords in plain text. This makes them inherently insecure and susceptible to interception or eavesdropping. Even when HTTPS is used, which many IBM i shops that are new to APIs don't, the fact that the credentials themselves aren't encrypted means that if the HTTPS encryption is broken the credentials are compromised. How many conversations to we have on the midrange list about people running old TLS versions?
2.
Basic Auth does not have a means of revocation or expiration. In most cases, usernames and passwords are created and never changed due to the hassle of changing things on the consumer and provider sides. This means if they are compromised, a bad actor could have access to the system for long periods of time before being caught.
3.
Most consumers of APIs that use Basic Auth store the passwords in plain text on their systems, exposing your system to being compromised.


Brian May



Profound Logic Software

Global Customer Lifecycle Principal


http://www.profoundlogic.com<http://www.profoundlogic.com/>
<http://www.profoundlogic.com/>

937-439-7925 Phone

877-224-7768 Toll Free



[Profound Logic Logo]



________________________________
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Patrik Schindler <poc@xxxxxxxxxx>
Sent: Friday, April 11, 2025 1:27 PM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Different approaches to expose RPG program outside of ibmi

Caution: This email originated from an external source. Please do not click links or open attachments unless you recognize the sender and know the content is safe.



Hello Brian,

Am 11.04.2025 um 16:38 schrieb Brian May <bmay@xxxxxxxxxxxxxxxxx>:

Basic Auth won't cut it.

Please elaborate.

:wq! PoC


--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.