How do you handle security/certificates when using the service proxy for Commerce Engine?

Question

Rob Earlam has a blog post about the service proxy that comes with the Commerce SDK. That post explains how:

the Service Proxy acts as a middleman between your engine code and your storefront code, allowing you to reference the types & controller endpoints defined in your engine, from your storefront code

Can anyone explain how the security works if I choose to invoke (custom) commerce engine commands through this proxy instead of going through the commerce connect layer?

According to the SXC developer's guide, connect-layer passes a certificate to the engine when you invoke a service in that layer. But as I understand it, accessing the engine via the service proxy means that I am bypassing the connect layer and thus have to deal with security myself.

Is that correct? If so, how do you recommend I do that?

Answer 1

No shouldn't be calling the Service Proxy directly, apologies if that wasn't clear in my post.

That service proxy is used by all of the out of the box SxA Storefront controls, as I mentioned it acts as the middle man allowing code running on XP to call controller routes declared on the engine, like so.

SxA Storefront -> Commerce Connect -> Service Proxy -> Commerce Engine

When you create custom engine functionality you should follow the same patter and utilise the Engine connect utilities provided in commerce connect to call your custom Service Proxy method, as then you will get the certificate authentication you mention above provided.

You use the Engine connect utility to retrieve a shops container that will give you a certificated authenticated way to access your service proxy method.

var container = EngineConnectUtility.GetShopsContainer(shopName: shopName, customerId: customerId);

I wrote a Product Compare plugin, that completed this like so:

var productCompareResult = new ProductCompareResult();
try
{
    var container = EngineConnectUtility.GetShopsContainer(shopName: shopName, customerId: customerId);
    var dataServiceActionQuerySingle = container.Compare.ByKey(customerId).Expand("Products");
    productCompareResult.ProductCompare = Proxy.GetValue(dataServiceActionQuerySingle);
    productCompareResult.Success = true;
}
catch (Exception ex)
{
    Log.Error($"Unable to retrieve Product Compare for shopName:'{shopName}', customerId'{customerId}'", ex, this);
}
    return productCompareResult;
}