How to protect the website static URL and Worklight console?

Question

I have developed a Worklight Web/Mobile website using AngularJS using Mobilefirst V7.0. I want to protect the URL of my web Application such that if some user directly tries to type the URL(for Ex:www.mydomain/app/dashboard) in the address bar with out proper Authentication, he should be pushed to login page for providing credentials(username/password), rather than forwarding to dashboard page . I'm used worklight AdapterbasedAuthentication for Authentication the user,using challangeHandler. Now I want to protect the WebSite URLs and Worklight console. Anyone can please tell me how to implement this in worklight. Please provide me some code for doing so if possible. Thank you everyone in advance.

Edit Hi Idan Adar,thaks for your response. The below following is my task to do: I'm trying to protect my Website Urls under tag by configuring in authenticationconfig.xml file, and when some ananymous user tries to access website by entering url manually, I'm trying to show the default worklight login.html page. On executing the below code I'm getting challangeHandler object in the browser and I'm not getting the login.html page which i required. Can you please suggest and tell me how to show the login.html page on unauthorized url access and suggest some solution to fix this issue.

<staticResources>
    <resource  id="logUploadServlet" securityTest="myWebUrlTest">
    <urlPatterns>/apps/services/preview/myProject/common/1.0/default/index.html/*</urlPatterns>
     </resource>
 </staticResources> 
<securityTests>
    <webSecurityTest name="myWebUrlTest">
        <testUser realm="SampleAppRealm"/>
    </webSecurityTest>
</securityTests> 
<realms> 
    <realm name="SampleAppRealm" loginModule="StrongDummy">
        <className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
        <parameter name="login-page" value="login.html" />
    </realm>
</realms>
<loginModules>
    <loginModule name="StrongDummy" expirationInSeconds="-1">
        <className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
    </loginModule>
</loginModules>

Idan Adar Idan Adar · Accepted Answer · 2015-09-16T10:15:57

Protecting the Worklight Console is not related to your application or to any code you have written. It is related to the application server that you deployed the Worklight Server to, be it WebSphere, Liberty or Tomcat.

What you need to do is to disallow access to certain URLs. In fact, usually these URLs would be internal to your network.

A simple topology would look like this:

PUBLIC INTERNET ---- HTTP SERVER / FIREWALL --- (optional)LOAD BALANCER --- WORKLIGHT SERVER(S)

So what you need to do is block any requests coming from the public Internet from accessing your private network.

For this you need to talk with your IT administrator.
You can direct him/her to the following user documentation topic about the available endpoints of the Worklight Server and its various operations: http://www-01.ibm.com/support/knowledgecenter/SSHS8R_6.3.0/com.ibm.worklight.installconfig.doc/admin/r_rest_api_endpoints.html

How to protect the website static URL and Worklight console?

1 Answers