Main Content

MATLABWeb App ServerSecurity

Caution

It is strongly recommended that you consult with your IT system administrator and discuss the security implications of installing the development version ofMATLAB®Web App Server™.

Installing and running the server on your network exposes your network and file system to risks. The machine running the server is most at risk from accidental or deliberate misuse of deployed web applications. Therefore, you must install the server software only on dedicated hardware. This machine can be a physical or virtual machine whose only purpose is to host web applications that connect to the server software. Using a physical or virtual machine limits the risk in the event that the machine is compromised.

Setting up of the development version ofMATLAB Web App Servercreates two low-privileged user accounts on the host machine—one for the server and one for applications. However, you can choose to use the same account. However, using the same account can introduce additional risks. In addition, through a process known asprivilege escalation, attackers may be able to exploit bugs in the operating system or network to obtain the privileges of ordinary or even administrative users. They can then attempt to access files or other intellectual property without permission.

The development version of the server relies on the authentication and authorization scheme of its host machine and network. Other than supporting HTTPS, it does not contain any additional mechanisms for authenticating or authorizing web application users. For more information, seeEnabling HTTPS.

You may be able to mitigate some of these risks by taking these precautions:

  • Restrict network access.Only trusted users can access the server and its associated applications.

  • Execute only trusted applications.Trust applications developed by only well-known, trusted, and authenticated sources.

  • Limit application functionality.Include in the application only those features of MATLAB required for the application to perform its function. For more information, seeAuthoring Secure Web Apps.

For a list of additional risks, seePotential Risks.

Related Topics