When developing new web services, we will prefer REST services.
When integrating with other University services, we will always prefer ESB or ETL integrations over direct connections between apps.
When connecting to web services, HTTPS should always be used where possible when the data is anything less than 100% public record. A really strong justification must be made for a HTTP connection. For non-HTTP based services, ensure that encryption is used.
Bypass the Proxies
When setting up our applications to connect to services outside the University, we should configure our applications to make outbound direct connections via HTTP/HTTPS, rather than going through the proxy server. This reduces points of failure and simplifies application configuration. This will usually require that firewall rules be created to grant our servers access to the outside world. Where the external web service as a reliable, agreed IP address, the firewall rule should allow only that IP address. Where the external service has no fixed IP but only offers a domain name, then the HTTP/HTTPS outbound firewall rule should allow access to any IP address.