Class loading and update detection

Background

Application shall not enable class reloading feature, which allows the modules reloading without further authentication in Prod Env, violates ISR’s security guideline.

 

Diagnosis

It can be identified by checking the config file: ibm-web-ext.xmi

If reloadingEabled = “true” and reloadInterval is not equal to zero, the class reloading feature is ON

 

Fix

1.     Update ibm-web-ext.xmi

a.     set reloadingEabled to “false”

b.     set reloadInterval to “0”

2.     Redeploy the EAR

 

Class loading and update detection settings