LI82632: ENCRYPT APP CREDENTIALS IN URL INSTEAD OF BASE64 ENCODE

APAR status

• Closed as program error.

Error description

• It was observed that when creating new application, the
  credentials (client_id & client_secret) are also created and are
  displayed on the page. These credentials are being communicated
  using HTTP method GET and are base64 encoded in URL. This makes
  the URL being logged in whole in the servers access logs.
  
  Encoded token is sent in URL which gets logged into servers
  access logs.
  
  Instead of doing base64 encoding in the URL we can encrypt using
  the same mechanism as used for the socialblock config
  

Local fix

Problem summary

• App credentials were passed in the page URL when applications or
  credentials were created or updated, the credentials were
  encoded when they should have been encrypted.
  This has been fixed to fully encrypt the credentials for
  additional security.
  

Problem conclusion

• Fix targeted at 10.0.1.7 and 10.0.5.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels