View source

<span style="color:blue">''This wiki page contains a draft of a proposed introductory white paper on OpenAjax Hub 2.0.''</span>
<hr>


=Introducing OpenAjax Hub 2.0 and Secure Mashups=

==Mashups – A Key Part of Web 2.0==
Whereas "Web 1.0" is about connecting people to network services, "Web 2.0" is about connecting people with people and extracting value from the community. With Web 2.0, the Web has expanded from dozens of markets with millions of people to also include millions of markets with dozens of people.

There are various technologies that help bring about Web 2.0: blogs, wikis, syndication feeds (RSS and Atom), lightweight Web services (often REST-based with JSON payloads), rich user experiences using Ajax techniques, and mashups. This white paper focuses on the last of these: mashups. In particular:

*The ''potential'' for mashups to revolutionize how Web applications are developed
*The ''industry challenges'' with mashups, particularly security and interoperability, that must be overcome to realize that potential
*How ''OpenAjax Hub 2.0'' addresses the key challenges

==Mashups, Widgets, Feeds and Web Services==

Within this white paper, the term "mashup" indicates a Web application using Open Web technologies (i.e., HTML/Ajax) that combines data from more than one source into a composite application. The classic mashup example has one part of the screen showing a mapping component (e.g., Google Maps) and another part of the screen showing a table of location-based data retrieved from a data feed (e.g., Craigslist), thereby creating a new and distinct web application that "remixes" and connects two independent web services in ways that were not originally provided by either source. Widgets and feeds (described below), along with simple web services, are the most popular building blocks for mashups. 

Mashups represent a technique for Web application development that leverages the industry's move towards SOA (service-oriented architecture), where server-side data is exposed as web services via APIs that can be invoked from client browsers (e.g., via XMLHttpRequest). Mashups allow easy remixing of data exposed via SOA and thereby represent a technique that allows rapid application assembly by non-programmers. This broadens the base of people who can build applications, reduces development time, and unleashes the innovation of end users to remix information sources so that they can gain insights and improve productivity. 

Large amounts of useful information have become available in the form of re-usable web services that can be queried by web applications running in the browser, often (but not always) using XMLHttpRequest. Some of the web services are compatible with the WS* set of standards (e.g., WSDL, WS-Security, WS-I, etc.) and/or SOAP; others use lightweight protocols such as JSON (JavaScript Object Notation) or simple XML, or one of the industry standards for simple syndication feeds (i.e., RSS or Atom). Countless Web services across a wide spectrum of categories have become available on the public Web. Within individual enterprises behind firewalls, companies have created web service APIs that allows internal Web applications to gain secure access to internal company databases. 

A key industry phenomenon is the rapid rise of "web widgets" (aka, '"widgets"' or "gadgets"), which represent a portable chunk of client-side code that can be installed and executed within other HTML-based web pages. Within this white paper, the term "widget" will be used as a shorthand for "web widget". 

==Programmer-Built Mashups vs. User-Built Mashups==

Mashups fall into two categories: 
*''Programmer-built mashups'' - Many Web applications built by individual Web developers fall into the programmer-built mashup category. In this scenario, a programmer uses Ajax technologies (e.g., HTML and JavaScript) to implement a Web page that combines 3rd-party web services, widgets and feeds as components within a Web page. 
*''User-built mashups'' - In this scenario, a non-programmer creates the mashup using mashup assembly tools, typically running in the browser. The mashup tools often allow the user to discover feeds and widgets from various sources, and then assemble those feeds and widgets onto a mashup canvas, possibly using drag-and-drop gestures to pull from a widget palette onto the mashup canvas. 

For Web developers, mashup techniques allow for greater efficiencies. Mashup techniques, particularly the discovery and use of packaged widgets, feeds, and Web services, allow Web developers to create compelling Web applications in minimal time.

However, the full promise of mashups comes when end users are able to build their own custom applications via component assembly – without having to submit application development requests to their IT department.

==The Business Value from User-Built Mashups==

A new generation of mashup assembly tools has emerged in the marketplace. These tools, typically browser-based, allow end users to discover widgets and feeds, and then assemble the widgets and feeds onto the browser-based canvas to create a custom application without programming. This process can be thought of as ''self-service application development'', where the user can address some of his software needs without having to submit requests to his IT department or purchasing single-purpose software products.
User-built mashups offer the following benefits to companies:

*''Faster, cheaper delivery of applications''. A lower skill set is needed to assemble applications than to build new applications from scratch.
*''Support innovation and new business opportunities''. Users are empowered to innovate and explore.
*''Gain valuable insights''. Line-of-business users are able to remix Enterprise and Web information, allowing them to make connections and recognize patterns.
*''Better align IT and business''. The IT department can concentrate on building reusable Web services and making mashup tools available to the company’s employees. 
*''Extend reach and value of SOA''. Service reuse illuminates the business value of SOA.
*''Application development long-tail''. The IT department by necessity will focus its resources on the most important business systems. Mashups allows end users to address the long tail of company application development.

==Mashup Security Concerns==

The full promise of mashups comes when end users are able to discover and integrate many of the great widgets (and associated data services) that exist on the public Internet with company’s proprietary widgets and data services.

However, many IT departments have held off on mashup adoption due to security fears. IT managers recognize the potential security vulnerabilities from allowing their users to mix proprietary widgets with public widgets within the same Web application. Due to how browsers work, a poorly architected mashup environment might allow malicious widgets  to gain access to data held in other widgets or, even more dangerous, to push and pull server data (e.g., by piggybacking session logins). 

The following sequence of illustrations highlight potential security vulnerabilities with mashups. The first illustration below shows a mashup consisting of three widgets, all of which are trustworthy. Widget A is a company widget that communicates in the background with a company server. Widgets B and C are trustworthy public widgets that each exchange information with a public Web server.


[/images/OAHub20Security_1.png /images/OAHub20Security_1.png]

Now assume that an end user has unknowingly created a mashup that appears to include trustworthy widgets, but in fact includes a malicious widget. If the mashup environment is not carefully programmed, the malicious widget will be able to push and pull data from the other widgets and other servers (as shown below by the brown arrows).

[/images/OAHub20Security_2.png /images/OAHub20Security_2.png]


==How OpenAjax Hub 2.0 Addresses the Security Challenges==

OpenAjax Hub 2.0 provides a secure mashup JavaScript library that isolates third party widgets into secure sandboxes and mediates messaging among the widgets with a security manager. Hub 2.0 isolates untrusted (potentially malicious) widgets and prevents them from accessing other parts of the mashup or accessing other servers. 

The illustration below depicts the basic security features from Hub 2.0. Hub 2.0 isolates each widget into its own secure sandbox (depicted below by the brown container surrounding each widget) and only allows widgets to communicate with each other through Hub’s messaging bus. Note that the malicious widget can only communicate with Hub 2.0 and cannot communicate directly with the other widgets or their servers. The security manager within Hub 2.0 provides the mechanism to prevent the malicious widget from passing messages directly or indirectly to other widgets.


[/images/OAHub20Security_3.png /images/OAHub20Security_3.png]


==OpenAjax Hub 2.0 – An Industry Standard==

OpenAjax Hub 2.0 was developed by the members of OpenAjax Alliance in order to develop an interoperable industry solution for secure mashups.

OpenAjax Hub 2.0 consists of the following components:

*''[/member/wiki/OpenAjax_Hub_2.0_Specification Specification]'' - A detailed Open Specification that defines Hub 2.0’s architecture and APIs
*''[http://sourceforge.net/projects/openajaxallianc Open source]'' – A commercial-ready open source reference implementation
*''Comprehensive test suite'' – Allows alternate implementations to verify that they implement the Hub 2.0 Specification correctly (found within open source project)
*''[/2008_InteropFest/mashupapp Sample mashup application]'' – Show vendors how OpenAjax Hub 2.0 can be used within a mashup assembly application (source code is in open source project)
*''White papers'' – A series of white papers that introduce Hub 2.0

==OpenAjax Hub, OpenAjax Widgets and OpenSocial Gadgets==

OpenAjax Hub 2.0 works with multiple widget technologies. OpenAjax Hub 2.0 can provide a Enterprise-ready widget isolation and secure messaging engine that can be integrated with OpenAjax Widgets (part of the [/member/wiki/OpenAjax_Metadata_1.0_Specification OpenAjax Metadata Specification]), OpenSocial Gadgets, and other industry widget technologies. 

==The OpenAjax Interoperability Vision==

OpenAjax Hub 2.0 is part of a broader set of initiatives at OpenAjax Alliance to accelerate customer success with the Web 2.0 technologies known as Ajax (i.e., standards-based HTML and JavaScript). In addition to OpenAjax Hub, the alliance has a companion initiative related to mashups, OpenAjax Widgets, which defines an Ajax interoperability standard for Ajax widgets. 

OpenAjax Alliance is an organization of vendors, open source projects and companies using Ajax that are dedicated to the successful adoption of open and interoperable Ajax-based Web technologies. OpenAjax members include more than 100 organizations, including many of the industry’s largest software companies, working towards the mutual goal of accelerating customer success with Ajax. The prime objective of the group is to accelerate customer success with Ajax by promoting a customer's ability to mix and match solutions from Ajax technology providers and to help drive the future of the Ajax ecosystem.