Security enhancements

Learn about the new security features and functions that are offered by WebSphere Commerce in the areas of authentication, authorization, and access control policies. These features and functions are important for the chief security officer or the security administrator responsible for securing your site.

SHA-256 cryptographic hash is used by default

In Version 7, SHA-1 was used by default. Now, the SHA-256 hash is used. For example, user passwords are hashed by using the SHA-256 algorithm.

HttpOnly flag is set by default for session cookies

By using httpOnly cookies, you can prevent cookies from being manipulated with JavaScript within the browser and reduce the possibility of cross-site scripting attacks and cookie theft. In Version 7, you enabled httpOnly for session cookies manually. Now, this flag is set by default.

Command line utilities support the -passwordFile parameter

When you use utilities, it is no longer necessary to supply a password on the command line. Utilities that require a password now support a -passwordFile parameter.

Non-sequential primary key for ORDERS and ADDRESS tables

The non-sequential key generation is enabled for ORDERS and ADDRESS tables. The enablement changes the KEYS table for the entries in column TABLENAME with values of ORDERS and ADDRESS. For more information, see Managing the KEYS table for non-sequential key enabled tables.