APAR status
Closed as program error.
Error description
It was observed that when creating new application, the credentials (client_id & client_secret) are also created and are displayed on the page. These credentials are being communicated using HTTP method GET and are base64 encoded in URL. This makes the URL being logged in whole in the servers access logs. Encoded token is sent in URL which gets logged into servers access logs. Instead of doing base64 encoding in the URL we can encrypt using the same mechanism as used for the socialblock config
Local fix
Problem summary
App credentials were passed in the page URL when applications or credentials were created or updated, the credentials were encoded when they should have been encrypted. This has been fixed to fully encrypt the credentials for additional security.
Problem conclusion
Fix targeted at 10.0.1.7 and 10.0.5.
Temporary fix
Comments
APAR Information
APAR number
LI82632
Reported component name
API CONNECT ENT
Reported component ID
5725Z2201
Reported release
A0X
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2022-05-25
Closed date
2022-07-13
Last modified date
2022-09-08
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
API CONNECT ENT
Fixed component ID
5725Z2201
Applicable component levels
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMNED","label":"IBM API Connect"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"A0X","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
08 September 2022