Skip to main content
C
CHASEONHO18-Opal
18-Opal
February 20, 2018
Solved

How to hide Thingworx Appkey, Composer?

  • February 20, 2018
  • 1 reply
  • 7501 views

Hi i have 2 question about Thingworx

 


1. Change URL
How can AppKey show mashups without being exposed?

 

2. Protect Composer page
Users typically go to the squal page if no home mashup is specified.
However, you can go directly to the Composer page by entering Composer directly.
Customers do not want it. Can I prevent a user other than a specific user or administrator from entering the Composer page?
Or can I replace the URL that currently enters the Composer page(<host>:<port>/Thingworx/Composer) with a specific format(<host>:<port>/IoT/<SomeKeyValue>/Composer)?

 

Thanks

This topic has been closed for replies.
Best answer by CHASEONHO

Thank you for answer.
But I wanted was to make it possible for specific user, not everyone, to go to the composer page.
To solve this problem, I found a way to limit access to the composer page through Tomcat configuration.
Tomcat's remote address configuration allows only the local host to access the composer page
thank

1 reply

P
PaiChung22-Sapphire I
22-Sapphire I
February 20, 2018

For appkeys the security is really in the limited permissions you assign to it, to only accomplish the tasks necessary.

As such these aren't generally recommended for Session based interactions like Mashups.

You can in certain use cases justify it, like general display boards or registration.

The recommended way to 'hide' it is to have it in the header of a call and not in the URL

 

For composer you can now set up user profiles such that if they do end up in composer they have no menus available to them.

 

I would also set up an organization to apply visibility so they can only see what they need to.

C
CHASEONHO18-OpalAuthor
18-Opal
February 20, 2018

Thank you for your reply.


What you learn from your answer is that it seems preferable to use Appkey to communicate with ThingWorx and not to use it to show mashups.

 

I think user can not access the composer's page is a better way than by modifying the user's profile that hiding the left-hand collection of the composer's page or using the organization to limit visibility

 

Could you change the URL of the composer page?
I am wondering if there is any way to change / Thingworx / Composer /.
I wonder if I can change the proposition called Composer to access the composer page with another proposition.

 

Now, I approach the composer page through the address / Thingworx / Composer.
But can I change to access the composer's page through / Thingworx / <Some Value>?

Thank you.

P
PaiChung22-Sapphire I
22-Sapphire I
February 22, 2018

We do not recommend moving/removing/aliasing whatever people might do to remove composer.

I understand the concern, but the only people that would end up in composer if you properly set redirects or home mashups is if they intentionally / specifically navigate to that link (<server>/Thingworx/Composer)

For regular end users I think that is rare, and if some of them do know Thingworx, they would go there because they are curious or ... trying to hack :D.

So properly setting up permissions and the profile will help with that.

Terms & ConditionsAccessibility statement