Mule Development – Best Practices

HTTP  Request Status Code Validator

By default the HTTP Request expects a 2xx status code from the target system, if there’s a different status code in the response it will throw an Exception. If you want to control different responses by adding some business logic, you have to configure the range of status codes considered as ‘valid’, by doing that you can put some logic after the HTTP Request, e.g. a Choice to take decisions based on the status code.

Web Service Consumer

• Import the wsdls and the xsds in your project
• Use the Webservice Consumer component and point it to the local wsdl 

Database Connector

• Queries
  • Use parameterized queries
  • Use dynamic queries only if you don’t have another choice, remember to validate the inputs previously (using dynamic queries could cause SQL-Injection vulnerability https://www.owasp.org/index.php/SQL_Injection) 

APIKit

• Use the APIKit features to generate the flows automatically
• Use the APIKit Exception Strategy to catch connector related exceptions
• It’s a good practice to disable the APIKit Console under all exposed environments (e.g. CloudHub environments, production -onPrem) as:
  • If the API Console is used without caution, you can affect real objects/data due to the fact that you don’t have a ‘mocking-services’ option. When using API Portals (Exchange Public/Private Portal) you can enable mocking services.
  • If an API Portal exists, the API Console is a redundancy.
  • If there are no policies applied, the API Console is a risk, due to point #1.

• For more information: 
  • https://docs.mulesoft.com/anypoint-platform-for-apis/apikit-tutorial

Validator

• Use Validator instead of throwing exceptions with Groovy Scripts
• For more information:
  • https://docs.mulesoft.com/mule-user-guide/v/3.9/validations-module
    

Flows reusability

• Use Flow references to separate and reuse common logic. The flow diagram should be clear, showing the steps of the use case.

SSL

• Always use HTTPS listeners, if your applications are exposed on the internet or if you have internal security regulations. HTTPS can also be terminated at load balancer level when using Dedicated Load Balancer or where the user is hosting their own load balancer on-premises.
• In NYU, there is a Dedicated Load Balancer configured. HTTPS in listener in Mule applications is not mandatory because the SSL termination is done on the DLB.
• For more information:
  • https://docs.mulesoft.com/mule-user-guide/v/3.9/http-listener-connector#https-protocol-configuration

Secure Application Properties

• Sensitive application properties such as access credentials and passwords can be obfuscated in CloudHub by using the Secure Application Properties feature. 
• Such feature can be used in conjunction with the Mule Credentials Vault that allows users to encrypt properties within the application properties files.
  • Use AES algorithm with a CBC mode.
  • Define a 128 bits key, if you want to use a 256 bits key, the JCE Unlimited Strength Jurisdiction Policy Files need to be installed in each workstation
    • For more information: Install the JCE Unlimited Strength Jurisdiction Policy
• For more information:
  • https://docs.mulesoft.com/runtime-manager/secure-application-properties
  • https://docs.mulesoft.com/mule-user-guide/v/3.9/mule-credentials-vault

Java custom code/Scripting

• Only if there is no other choice.

Cache

• Use the Cache scope whenever possible, to wrap HTTP calls / flows / logic that obtain/produce information that doesn’t change frequently
• Define a ttl (time to live) based on an analysis, it shouldn’t be arbitrary
• For more information:
  • https://docs.mulesoft.com/mule-user-guide/v/3.9/cache-scope

Unit and Integration Testing

• Create significative Unit tests using MUnit
  • Unit Testing Best Practices
• Create significative Integration tests using MUnit
  • Integration Testing Best Practices

Mule Deploy Maven Plugin

• Include the Mule Maven Deploy Plugin in each application
  • Check the following how-to Mule Applications Configurations for CI/CD

Debugging & Troubleshooting

• Use Anypoint Studio Debugger to debug your Mule Applications.

Wire Logging

To enable a more detailed logging to see all the HTTP requests and responses, configure the following loggers in src/main/resources/log4j2.xml