About Securing Hybrid Mobile Applications

Since hybrid mobile applications are JavaScript HTML5 applications, many of the same security practices that apply to web applications apply to hybrid mobile applications. However, there are additional considerations when you’re deploying to mobile devices.

The Cordova documentation includes a Security Guide that provides some security best practices for Cordova applications. You can use this guide as a starting point to secure your hybrid mobile application. However, as Cordova points out, security is a complicated topic, and its guide is not exhaustive.

JET adopts the AppConfig approach to manage mobile applications in the enterprise. AppConfig is an industry-sponsored community that provides tools and best practices to configure and secure mobile applications. Oracle JET provides the cordova-plugin-emm-app-config plugin, described in Managing App Configuration for JET Hybrid Mobile Apps, to facilitate this process.

Managing Authentication in JET Hybrid Mobile Apps

Authenticating end users of a hybrid mobile app and propagating the identity of the authenticated end users to back-end systems so that the end user can access secured resources is a requirement that you will have to frequently implement.

Oracle JET provides a Cordova plugin, cordova-plugin-oracle-idm-auth, to assist you with these tasks. Add this plugin to hybrid mobile apps that you deploy to Android and iOS devices using the Oracle JET CLI as follows:

ojet add plugin cordova-plugin-oracle-idm-auth

For more information about using this plugin in your hybrid mobile app, see https://github.com/oracle/cordova-plugin-oracle-idm-auth. This plugin can be used in any Cordova-based hybrid mobile app, not just JET hybrid mobile apps.

Managing App Configuration for JET Hybrid Mobile Apps

Many enterprises make use of Enterprise Mobility Management (EMM) software to manage mobile devices, applications, wireless networks, and other mobile computing services.

EMM software allows administrators to configure mobile apps via a web console and apply the configuration to the app on every managed device as part of the app installation process. This configuration typically consists of generic name-value pairs defined by the app developer, such as URI, port numbers, tenant IDs, or CSS skin configurations.

The Android and iOS platforms support this functionality natively, but retrieving app configuration data and being alerted when it has changed is just as important for Cordova-based hybrid mobile apps. To make this possible, Oracle JET provides the cordova-plugin-emm-app-config Cordova plugin that can be used to implement app configuration in JET mobile apps on the Android and iOS platforms. Using this plugin, you can retrieve the app configuration data at any point in the app lifecycle, including when the EMM server changes the app configuration.

You can add the cordova-plugin-emm-app-config to your hybrid mobile app using the Oracle JET CLI as follows:

ojet add plugin cordova-plugin-emm-app-config

For more information about this plugin, see https://github.com/oracle/cordova-plugin-emm-app-config. This plugin can be used in any Cordova-based hybrid mobile app, not just JET hybrid apps.

Vendors and other stakeholders in the application configuration software sector formed the AppConfig community to provide tools and best practices. For more information, see http://appconfig.org/.