Worklight PushAdapter issues on production environment - push

Question

Worklight PushAdapter sample works fine in development env, i.e. worklight studio, but couples issues occur while moving to production.
backend application can not call the push procedure due to security issues. if set securityTest="wl_unprotected" , it might be a risk in production, any other solutions?
in the onPoll function of the eventSource, if call other adapters' procedure, it raise security issues in production too, though works fine in dev.
e.g.
PushAdapter:
WL.Server.createEventSource({
name: 'PushEventSource',
onDeviceSubscribe: 'deviceSubscribeFunc',
onDeviceUnsubscribe: 'deviceUnsubscribeFunc',
securityTest:'SingleStepAuthAdapter-securityTest',
poll:{
interval: 120,
onPoll: 'getNotificationFromBackend'
}
});
function getNotificationFromBackend(){
var notifications = WL.Server.invokeProcedure({
adapter : 'MessageAdapter',
procedure : 'getMessages',
parameters : []
});
WL.Logger.error("notifications: " + JSON.stringify(notifications));
...
}
Error Messages:
[14-2-13 9:11:45:382 CST] 0000003d ht.integration.js.JavaScriptIntegrationLibraryImplementation E notifications: {"isSuccessful":false,"errors":["Runtime: The resource 'proc:MessageAdapter.getMessages' should only be accessed when authenticated in realm 'wl_antiXSRFRealm'."],"warnings":[],"info":[]} [project XXX]
Could you help pls? thanks in advanced.

Answer 1

The default security test for adapter procedures contains Anti-XSRF protection, but this configuration can be overridden by either:
a.Implementing your own authentication realm.
b.Disabling the authentication requirement for a specific procedure. You can do so by adding
the securityTest="wl_unprotected" property to the element in the adapter XML file.
Please refer to below post for a similar question.
IBM Worklight 6.0.0.1 - Push notifications polling not working in Production environment

Answer 2

Worklight should allow a listening port number which is protected by the enterprise firewall to be assigned to the push adapter. If such feature exists, then it should be just a matter of configuring the firewall on production to allow only the push requests from a specific push source.
If such a feature is not available, then the push adapter should be protected by a security test. And the push source should authenticate using a special login ID when pushing data. This should be doable.