- Application – A Lightning\/web app (WPE runtime) or Lightning\/Spark app (Spark runtime) loaded from the web.<\/li>
- Thunder client – javascript client used by application<\/li>
- WPE\/Spark – Application Runtime Environments<\/li>
- Thunder – Web Platform for Embedded Framework for services<\/li>
- Security Agent – A thunder plugin. Accessible only by COM\/RPC only by application runtimes.<\/li>
- Plugin1 – Represents any plugin used as a service. Accessible by JSON\/RPC<\/li>
- thunder_permissions.conf – configuration for permissions of applications to access Thunder services.<\/li><\/ul>
\n\n<\/p>
![](\"\/wp-content\/uploads\/sites\/16\/2023\/09\/ThunderSecurityAgentFlow.png\")
Figure 2. Sequence Diagram<\/h2>
Notes: The Spark or WPE runtime loads the application. The application that wants to use Thunder services creates the ThunderClient. When the client is created, it requests a security token from the runtime. The runtime then requests the token directly from the security agent through COM\/RPC using the application context (the application’s URL). The security agent then creates and returns the token and returns it to the client. As noted, the token is not returned back to the application that creates the Thunder client. Once the application has created the Thunder Client, it then can invoke a service on a plugin… in this case Plugin1.foo(). The Thunder Client creates the request to Thunder by including the security token. The Thunder Framework (not the actual plugin) checks with the security plugin to determine if the application can access this plugin based on the permissions file, and if so, allows the plugin to perform the request with the result being returned to the application.<\/p>
\n\n<\/p>
![](\"\/wp-content\/uploads\/sites\/16\/2023\/09\/ThunderSecuritySequenceDiagram.png\")
Sending Security Token in JSON-RPC Requests<\/h2>
Web Apps<\/h3>
Web Apps that use ThunderJS to access plugins don’t have to do anything to pass the security token. This is handled by the WPE runtime and ThunderJS. WPE runtime will get details of the web app (URL) and send these details to WPEFramework process to get a security token. ThunderJS client will read this token and include it as part of each request.<\/p>
Native Apps<\/h3>