The project I support has a public facing JBoss web site that consists of a mashup, which allows anonymous users through a virtual proxy to access data contained in Qlik Sense apps running on a Qlik Sense Enterprise server. The web application establishes a session with the Qlik Enterprise server and uses web sockets to invoke Qlik API calls. Anonymous access only allows read-only access but there is still a concern that it might be possible for a hacker to create their own client application that could bypass our web application and connect directly to our Qlik Sense Enterprise server. I would be grateful for any insights that one might have on how to best secure our Qlik Sense Enterprise server so that it only accepts client calls invoked from our web application.
Thanks,
Brian
