RESTful API security review and refinements

[Ghislain Hachey]

A number of things need to be reviewed:

• Need roles for public access that read all the dashboard pages, etc but not individual records
• Need roles to read API end points but mostly used by external apps.
• A review of how to control access to the RESTful API (and not just for login users in the web app)
• Put the backend and frontend through a web penetration testing tool to address any security issues.
• Anything else?

‌

[Ghislain Hachey]

This issue is a little related to https://bitbucket.org/softwords/pineapples/issues/1118/properly-document-the-restful-api-hpr-2022

[Ghislain Hachey]

Most of this was done. A penetration testing tool would be a good thing eventually and can be done within its own specific work.

[Ghislain Hachey]

Most of this was done. A penetration testing tool would be a good thing eventually and can be done within its own specific work.