WSO2 Enterprise Store 1.0.0: security

Question

In WSO2 Enterprise Store 1.0.0 there is a lack of security on some aspects.

For example: several public files contain sensitive data as the location and clear password of keystores:

• /store/config/publisher.json
• /publisher/config/publisher.json

I'm still trying to figure why these data are needed on client side...

Is there any configuration setting to solve this issue?

Answer 1

You can solve this issue by adding following URL mapping to the jaggery.conf inside both publisher and store apps.

{
 "url": "/config/*",
 "path": "/"
}