Rob Earlam has a blog post about the service proxy that comes with the Commerce SDK. That post explains how:
the Service Proxy acts as a middleman between your engine code and your storefront code, allowing you to reference the types & controller endpoints defined in your engine, from your storefront code
Can anyone explain how the security works if I choose to invoke (custom) commerce engine commands through this proxy instead of going through the commerce connect layer?
According to the SXC developer's guide, connect-layer passes a certificate to the engine when you invoke a service in that layer. But as I understand it, accessing the engine via the service proxy means that I am bypassing the connect layer and thus have to deal with security myself.
Is that correct? If so, how do you recommend I do that?