1. https certificate would apply to the cache and csp sites defined under IIS.  It would apply  to everyrhing really.

2. Not sure about html landing page being a security threat. That depends on your setup. Do you embed http parts in your (future) https pages?

I'd recommend as a first step to install let's encrypt certificate - it's free and easy.

Then force http->https redirect on your iis server.

After that check how your html landing page behaves.

Thank you! That's very useful.

Is there a way to return real implementation class?

For example, consider these classes:

Class App.Use {

ClassMethod Test()
{
    w 1/0
}
}

and:

Class App.Use2 Extends App.Use
{
}

If I call:

do ##class(App.Use2).Test()

I get  the following CLS source line:

App.Use2:Test+1

Yet, the relevant code is actually implemented in

App.Use:Test+1

One approach I see is checking %Dictionary.MethodDefinition recursively till I find a method definition, but there's bound to be many problems multiple inheritance.

Here's how to view stream properties in SQL.  Alternatively you can use %CONTAINS to search the stream.

Another way would be writing an sql procedure that gets stream, converts it to object  and checks if it has the token. Would be slow though. Maybe do a simple [ check first and then pass only those rows that have the token into sql procedure?

Can you parse the stream when you receive the message?

You can set PasswordValidationRoutine in  the Security.System class. When a user is created in the Cache security database, or a user changes their password, the specified routine is called to validate the password. A tag reference may also be included in the property. The routine should be provided by the user, and must exist in the %SYS namespace (it may be mapped to a different database however.) The routine will take 2 parameters, a Username and new password, and should return a %Status code of $$$OK for successful password validation, or an error code formatted into a %Status variable. The username passed into the function will be in all lowercase, and will contain the domain name if multiple domains are enabled for the system.
 

Second line should be:

Set status=context.ReturnedIds.SetAt(callresponse.PatientLookupResult.Patients.GetAt(1).IDs.GetAt(1).ID, 1)

You need to modify your BP definition to something like this:

<assign property="context.ReturnedIds" value="callresponse.PatientLookupResult.Patients.GetAt(1).IDs.GetAt(1).ID" action="set" key="1"/>

To copy all IDs for all patients you'll need to iterate over results.