Rob Earlam has a blog post about the service proxy that comes with the Commerce SDK. That post explains how:

the Service Proxy acts as a middleman between your engine code and your storefront code, allowing you to reference the types & controller endpoints defined in your engine, from your storefront code

Can anyone explain how the security works if I choose to invoke (custom) commerce engine commands through this proxy instead of going through the commerce connect layer?

According to the SXC developer's guide, connect-layer passes a certificate to the engine when you invoke a service in that layer. But as I understand it, accessing the engine via the service proxy means that I am bypassing the connect layer and thus have to deal with security myself.

Is that correct? If so, how do you recommend I do that?

1 Answer 1


No shouldn't be calling the Service Proxy directly, apologies if that wasn't clear in my post.

That service proxy is used by all of the out of the box SxA Storefront controls, as I mentioned it acts as the middle man allowing code running on XP to call controller routes declared on the engine, like so.

SxA Storefront -> Commerce Connect -> Service Proxy -> Commerce Engine

When you create custom engine functionality you should follow the same patter and utilise the Engine connect utilities provided in commerce connect to call your custom Service Proxy method, as then you will get the certificate authentication you mention above provided.

You use the Engine connect utility to retrieve a shops container that will give you a certificated authenticated way to access your service proxy method.

var container = EngineConnectUtility.GetShopsContainer(shopName: shopName, customerId: customerId);

I wrote a Product Compare plugin, that completed this like so:

var productCompareResult = new ProductCompareResult();
    var container = EngineConnectUtility.GetShopsContainer(shopName: shopName, customerId: customerId);
    var dataServiceActionQuerySingle = container.Compare.ByKey(customerId).Expand("Products");
    productCompareResult.ProductCompare = Proxy.GetValue(dataServiceActionQuerySingle);
    productCompareResult.Success = true;
catch (Exception ex)
    Log.Error($"Unable to retrieve Product Compare for shopName:'{shopName}', customerId'{customerId}'", ex, this);
    return productCompareResult;
  • What is this a plugin for? So if I need to invoke some custom command that I have created in the commerce engine, I need to add a pipeline to commerce connect (or override an existing) that performs this invocation?
    – ebug
    Nov 8, 2018 at 12:38
  • If I decompile the commerce connect code and take a look at one of the pipelines in there (AddCartLines), it does not look like your code, when they try to invoke the proxy: Proxy.DoCommand<CommerceCommand>((DataServiceActionQuerySingle<M0>) this.GetContainer(shopName, userId, customerId, "", currency, new DateTime?()).AddCartLine(cartId, itemId, quantity)); Can you explain why that is?
    – ebug
    Nov 8, 2018 at 12:39
  • Looking a bit more into the commerce connect code, I found that the GetContainer method actually uses EngineConnectUtility.GetShopsContainer like you do, so it works the way you explain. So I guess it's all about working those connect pipelines
    – ebug
    Nov 8, 2018 at 13:43
  • 1
    Yeah exactly, you don't need to create your own Commerce Connect pipelines if you don't need to, you can just base your functionality on what the OOTB commerce connect pipeline processors do. That's what I based my code above on.
    – Rob Earlam
    Nov 8, 2018 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.