Technical Whitepaper:

POWERSERVER
2022 R3 SECURITY
MEASURES

Table of Contents
1Introduction ..........................................................................................................32

Automatic Encryption ............................................................................................43

Client App Integrity ...............................................................................................44Transport Security ................................................................................................55

Cookie Validation ..................................................................................................66

Token-Based Authentication .................................................................................6726.1

Using the traditional authentication method for development only ..................... 66.2

Implementing token-based authentication for production.................................... 66.2.1

Approach 1: Use a built-in auth template to set up built-in authentication .. 76.2.2

Approach 2: Use an authentication server that already exists ...................... 86.2.3

Approach 3: Set up a new authentication server ............................................ 8

Data Security ........................................................................................................87.1

Hosting the .NET server and database in the same LAN ...................................... 8

7.2

Using a firewall ......................................................................................................... 97.3

Setting up database connections using caches .................................................... 97.4

Session and transaction management ................................................................... 9© 2024 Appeon. All Rights Reserved1 INTRODUCTION
Installable cloud apps deployed from PowerServer 2022 R3 adopt standard cloud-nativearchitecture running on the .NET framework and adhere to industry best practices forsecurity. All SQLs and DataWindows execute behind the firewall. Data is accessed
through industry-standard REST APIs, secured by OAuth or JWT. The client app is
encrypted, digitally signed, and checked for integrity.

This document explains the detailed security measures that PowerServer 2022 R3 has
inherently implemented, or you can undertake, to protect the privacy, integrity, andavailability of data and files transmitted for the running of installable cloud apps:

3•

Automatic Encryption•

Client App Security•

Transport Security•

Cookie Validation•

Token-Based Authentication•

Data Security© 2024 Appeon. All Rights Reserved

2 AUTOMATIC ENCRYPTION
Encryption is an effective way to reduce the probability of a security breach in the apps.
PowerServer automatically encrypts the app files and sensitive information, and theencryption algorithm is uniformly AES 128-bit.
•Encryption of account information in the server configuration
If you export a PowerServer project to a .srj file, the database connection informationin the file is encrypted. Because web server profiles contain the FTP username andpassword, the file that stores the profiles is also encrypted.

•Encryption of the compiled p-code files
When compiling a PowerServer project, every SRW, SRD, SRU, etc. file from theapplication PBLs is compiled into its individual corresponding p-code file (that havenew file extensions, such as .dwo, .apl, .fun, .win, .udo) instead of a monolithic PBD
file. The PowerServer project configuration settings provide the option “Encrypt all
the compiled p-code files”. If the option is selected, the p-code files generated during
app compilation are encrypted.

•Encryption of the app manifest file
Each installable cloud app contains an app manifest file that lists every filecontained in the installable cloud app and the file hash code. The manifest isencrypted.

3 CLIENT APP INTEGRITY
When a user loads and runs an installable cloud app, the files to be downloaded to theclient include a supporting program (Cloud App Launcher) and supporting runtime files(relevant PowerBuilder Runtime files). The supporting program and files can be jointly
used by multiple installable cloud apps; and the app executable file, P-code files
compiled and granularized from the source code, resource files, OCX files, and otherexternal files used by the app.

4© 2024 Appeon. All Rights ReservedIt is important to ensure that the client app only uses the files from the original
deployment. Therefore, PowerServer is designed with the following mechanisms toenforce the client app integrity.
•Integrity assurance of the app files
Each installable cloud app contains a file manifest that lists every file contained inthe installable cloud app and the hash code of each file.
The PowerServer project configuration settings provide the option “Validate theapplication integrity before the app runs”. Checking this option will check that theapp files to be executed on the client have not been tampered with outside of thePowerServer compile process.

•Digital signing of the app executable
The app executable file (appname.exe) can be digitally signed. Having a valid digital
signature helps to ensure the authenticity and integrity of the app’s executable file.

4 TRANSPORT SECURITY
Installable cloud apps make HTTP requests to the web server to download the app files
and necessary runtime files and make HTTP requests to PowerServer APIs to request
services and transfer data. It is strongly recommended that you enable TLS 1.2/TLS 1.3
for the file transfer between the client and the web server, and also enable TLS 1.2/TLS
1.3 for the REST communications between the client and the .NET server.
HTTPS is essential for your app’s security. Encrypting data in transit via HTTPS will
prevent attackers from being able to view or interact with data. Once the HTTPS isenabled, all information transports are encrypted, which includes the full URL, cookies,
data (binary or plain text), session ID, token, and other headers.
HTTPS encryption renders data sent across a network from the client to the server
unreadable to sniffers. If a sniffer intercepts the data, it finds the data unusable because
the data is encrypted.

5© 2024 Appeon. All Rights Reserved

5 COOKIE VALIDATION
It is possible to add a cookie validation script in the app folder of an installable cloud
app at the web server. When a client requests to run the app, the web server gets andvalidates the cookie from the client against the script, and determines whether to allow
the client to download the required files (CloudAppLauncher, the app runtime files etc.)
for running the app. The cookie validation is performed at the start of every client
session. In addition, with the GetHttpRequestHeader and GetHttpRequestHeadersfunctions of the Application object, the HTTPClient object in the app can get the cookie
from the HTTP request header, and then validate the cookie if necessary.

6 TOKEN-BASED AUTHENTICATION
6.1 Using the traditional authentication method for development only
Communication between the client app and the .NET server is through standard REST
APIs. If you select the “Do not use auth service” option in the PowerServer projectsettings, the generated REST APIs do not perform any authentication and can be readily
accessed. During development, it should not be a big concern, but when going into
production, especially if the REST APIs are exposed over the Internet, then it is highly
recommended to implement some token-based authentication for the REST APIs.

6.2 Implementing token-based authentication for production
Token-based authentication helps to mitigate REST API security risks as follows:•An app user’s access to any resource will be denied unless he/she is granted atoken.

•An app user should only have the required set of permissions to perform actions on
PowerServer’s REST APIs for which they are authorized, and no more.

Below is a sample workflow of token-based authentication. As illustrated in the workflow(Figure 2), the client sends the user credentials to the authentication service/server(built-in or external). The authentication service/server validates the user, and if6© 2024 Appeon. All Rights Reserved

validation is successful, it authorizes and returns a token to the client. Then, the client
will send all the subsequent requests with the token, and the PowerServer’s REST APIs
will validate the token in the request with the authentication service/server before
handing the request.
Figure 2

There are various approaches to configuring an authentication service/server to workwith PowerServer’s REST APIs. Which one to select would depend on your security
requirements and the existing security infrastructure in your company.
6.2.1 Approach 1: Use a built-in auth template to set up built-in authentication
The steps are simple and quick if you decide to implement token-based authentication
by utilizing one of the three built-in auth template options in the PowerServer projectsettings:▪

Use built-in JWT server▪

Use built-in AWS Cognito serverWith this built-in approach, the auth service/server is hosted in the PowerServer solution,and the users and their credentials can be either stored in a .cs file in the solution or thedesignated authentication database. Follow the instructions in the respective document
to implement the built-in authentication for the .NET server: Using JWT, and Using
Amazon Cognito.

7© 2024 Appeon. All Rights Reserved

6.2.2 Approach 2: Use an authentication server that already exists
PowerServer 2022 R3 provides templates that can be easily extended to support anexisting authentication server that works with the OAuth 2.0 flows or JWT, such as Azure
AD, Azure AD B2C, Visual Guard, and Okta OIDC (OpenID Connect). If you have already
implemented such an authentication server, you can select the “Use external Azure
Active Directory service” (for Azure AD and Azure AD B2C) or “Use external auth service”(for Visual Guard and Okta OIDC) option in the PowerServer project settings, and follow
the instructions in this document to implement it for the .NET server: Using external
Active Directory service; and Using other authentication servers.
6.2.3 Approach 3: Set up a new authentication server
Sooner or later you may want to set up your own authentication server so that you canshare it among multiple projects that may be developed with other tools and languages.
The requirement for the new authentication server is that it must comply with the OAuth
2.0 flows or JWT. There is a long list of notable OAuth providers, select whichever one
you like, and then follow the relevant documentation to set up the server.
To have the new authentication server working with a PowerServer project, please selectthe “Use external auth service” option in the PowerServer project settings, and follow theinstructions in this document: Using other authentication servers.

7 DATA SECURITY
Data security is a core focus of cloud app security. PowerServer has taken a number ofmeasures to enhance the data security in installable cloud apps, assuming that you
follow the best practices recommended in this section.

7.1 Hosting the .NET server and database in the same LAN
It is important to publish the PowerServer’s REST APIs to a server that resides in thesame LAN as the database server. This way, the data operations of the app will be
executed in the LAN behind the firewall, which reduces the vulnerability to cyber-attacks.
Specifically speaking, in installable cloud apps,

8© 2024 Appeon. All Rights Reserved

•

Static DataWindows/DataStores are all .NET models and hosted on the .NETserver;•Embedded SQLs are all SQL strings hosted on the .NET server.

•

Dynamic DataWindows/DataStores will be created at the client and have its SQL
sent as strings, encrypted, to the .NET server during runtime.

•

Dynamic SQLs will be created at the client and sent as strings, encrypted, tothe .NET server during runtime.

When the client app performs a data request, it calls the corresponding REST API, andthen the REST API is executed by the .NET server using the corresponding .NET model or
SQL strings. After that, the .NET server returns the result set in JSON format to the client.
During the process, the data accessing and handling functions are all restricted, andunder control, on the server side (.NET server and database server).

7.2 Using a firewall
Firewalls have long been the first line of defense in network security. In installable cloudapps, data is exchanged between the client, and the servers (the .NET server and thedatabase server), so it is important to implement a firewall solution for the apps thatadhere to best practices, such as configuring a whitelist for web intrusion prevention.

7.3 Setting up database connections using caches
An inherent security feature of installable cloud apps is that you no longer need to keep
the database connection information (including user ID, password, DB connection string,etc.) on the client side. To implement a database connection, you configure theconnection information in the PowerServer REST API project (that resides on the server)
and then map each transaction object from the client app to a server cache. This way,
the cache settings are deployed and stored in the server APIs, and the connection
information will be only used by the .NET server for the database connection.

7.4 Session and transaction management
Session and transaction timeouts can be easily applied to installable cloud apps bysimply configuring a setting in the PowerServer project configuration. This feature helps

9© 2024 Appeon. All Rights Reservedsafeguard the application from unauthorized access when authorized users have
stepped away momentarily or forgotten to log out from the system.

About Appeon
Appeon helps software developers build faster, better, business apps. PowerBuilder, the flagshipproduct of the company, has been used by over 18,000 organizations worldwide, and has a long
history of being relied on for mission-critical systems. Appeon’s products simplify and accelerate
the development of data-rich cloud apps for Windows.
For more information visit www.appeon.com, or follow Appeon on social media: Facebook,YouTube, Twitter, LinkedIn.
For customers interested in learning more about Appeon products:
Global Customer Service Center: +1-877-3APPEON (+1-877-327-7366), sales@appeon.com

10© 2024 Appeon. All Rights Reserved