Flowable REST API authentication and privileges
How Flowable REST endpoints authenticate callers: basic authentication over HTTPS, the rest-access-api privilege, the verify-privilege and any-user modes, and when to replace basic auth with tokens.
Flowable security and access control
Securing Flowable engines and APIs: authentication, default accounts, password storage, scripting and XML risks, and the authorization checks the engine leaves to your application.
Changing the default Flowable rest-admin account
Removing the risk of Flowable's demo credentials: the default rest-admin user in the REST app and Docker examples, creating real admin users, privileges and password policy before exposure.
Encoding Flowable IDM passwords
Fixing Flowable's default of plain-text passwords in the IDM tables: configuring a password encoder such as BCrypt, migrating existing users, or disabling the IDM engine when identities live in LDAP or an IdP.
Flowable secure scripting for script tasks
Limiting what Flowable script tasks can do: the secure JavaScript configurator on Rhino, class allow lists, maximum execution time, memory and stack depth, and why scripts from non-developers need it.
Enabling safe BPMN XML parsing in Flowable
Protecting a Flowable engine that accepts uploaded models: the enableSafeBpmnXml setting, the XML attacks it guards against, platform requirements, and controls on who may deploy.
Task and process authorization in Flowable applications
Designing authorization around Flowable: candidate groups and identity links, the unenforced potentialStarter setting, checks your API layer must perform before completing tasks or starting processes, and audit of decisions.
Tenant data isolation in multi-tenant Flowable
Keeping tenants apart in a shared Flowable engine: tenant IDs on every entity, tenant filters on every query, signals scoped to tenants, and the application-level enforcement Flowable expects.
Masking secrets in Flowable HTTP task headers
Keeping API keys and tokens out of Flowable logs and variables: secure HTTP headers in the HTTP task, outbound credential storage, and reviewing existing models for exposed secrets.
Securing Flowable expressions and the REST surface
Reducing attack surface on Flowable deployments: which REST endpoints to expose, the actuator endpoint, configuration beans exposed to expressions, and dependency updates for Spring and Jackson.
