smart-on-fhir-tutorial | SMART on FHIR developer tutorial
kandi X-RAY | smart-on-fhir-tutorial Summary
kandi X-RAY | smart-on-fhir-tutorial Summary
SMART on FHIR developer tutorial
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Initialize FH client .
- The default ffint environment
- format a value into a string
- Handle the response
- Search a single selector .
- Animation animation class
- Creates a new dom matcher .
- Calculate the md5 hash .
- Creates a new matcher with the given selector and context .
- incoming request
smart-on-fhir-tutorial Key Features
smart-on-fhir-tutorial Examples and Code Snippets
Community Discussions
Trending Discussions on smart-on-fhir-tutorial
QUESTION
It is very clear to me how an EHR using a SMART application can authenticate that requests coming from the SMART application are legitimately coming from the authentic SMART application. However, I'm not seeing how the SMART application knows that the request coming from the EHR is a legitimate request. Is there a standard way the SMART application can authenticate that the incoming request from an EHR is actually a request from an EHR that the SMART application has registered with? In other words, is there a way that is build into the SMART specification that allows the SMART application to limit use to authenticated registered EHRs? Is there a step in the OAUTH2 protocol that ensures this?
I am looking at the SMART authorization guide here: http://docs.smarthealthit.org/authorization/
and the Cerner tutorial/demo here: http://engineering.cerner.com/smart-on-fhir-tutorial/
...ANSWER
Answered 2018-Mar-02 at 23:29We're talking about the "EHR Launch" flow here, where an app has been launched by an EHR. This lauch includes an iss
parameter indicating the EHR that (supposedly!) initiated the launch, and an opaque launch
parameter.
At this point, the app can't authenticate the request, but it can:
- Check to ensure that the
iss
value matches the issuer for an EHR that it knows (and for which it has aclient_id
) - Proceed with the launch by redirecting to the EHR. If the launch works, the launch ID was valid. If, on the other hand, the EHR doesn't recognize the launch ID or hasn't associated it with the current app's
client_id
, then the launch fails.
This is a functional approach to validating the EHR's identity: effectively, the app uses the launch protocol to ask the EHR if this launch is valid.
(Please do raise the point on chat.fhir.org if you think this protocol leaves an important functionality or security gap!)
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install smart-on-fhir-tutorial
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page