A Case Study on the Security Policies for RESTful Open API Platform of Human Resource Management

The introduction of RESTful web service and open APIs helps to transfer many Web applications once built on traditional database and JSP/ASP techniques to open API platforms. However, there are still concerns about the security of data at the backend. This paper presents a Human Resource Open Platform (HROP) using Open Authorization (OAuth) protocol. To ensure its security, different policies have been imposed at various levels (platform, user, application and service) and achieved via infrastructure design, service layered protection and strict permission checks. This paper concludes by suggesting ways that developers can exploit to achieve more secure and user-controllable open platform applications.