Security
========

Standard measures
-----------------

To prevent unauthorized access to the SCWS, a number of security measures built in the operating system and the standard browsers are taken advantage of.

Network restriction
...................

First, the SCWS is listening only to the 127.0.0.1 interface (localhost). This prevents any connection from the network. Only local processes can therefore contact the service.

.. _security_cors:

Cross-origin restriction
........................

In addition, the Cross-Origin Resource Sharing (CORS) mechanism, implemented by all browsers, prevents pages served by unauthorized servers to access the service. The value of the ``Access-Control-Allow-Origin`` HTTP header returned by the service is determined by the :ref:`webapp_certificate`, and page originating from a different server will be denied access.

.. _security_auth:

Proprietary authentication scheme
---------------------------------

In addition to the measures described above, a proprietary scheme, using public key cryptography and challenge-response, has been defined to ensure that only authorized web applications can use the service. 

When the web application initially contacts the SCWS (through a :js:func:`SCWS.findService` call), it must provide a static :ref:`webapp_certificate`, generated by Idopte for each web application. This string certifies the server URL, and is used in combination with the CORS mechanism to ensure the web application is legitimate.

Moreover, the web application is given a challenge as a result of this method call. This challenge must be signed on the application server side, and the signature must be sent back to the client side and transmitted to the SCWS (through a :js:func:`SCWS.createEnvironment` call). This will then grant access to all subsequent calls to API functions.

Note that, for this scheme to make sense, the server must be able to identify that the challenge signature request comes from a genuine client. This is the responsiblity of the web application developer to guarantee this (for example using cookies, or the session mechanisms provided by the server-side framework).

See the :doc:`../2_API/envsetup` chapter for more information.