Mobile Development

Question

Now that Apex 4.1 is out, I see that the statement of direction has been updated to indicate that the next version 4.2 will have better support for declarative, mobile development.
Clearly there are many considerations involved in developing and deploying mobile data-driven applications. The first one is whether to even build a mobile-browser-based site as opposed to a native "app". There are pros and cons for each approach. Given that Oracle/Apex has committed to the jQuery Mobile framework, which will probably be released in the next few weeks, I just wanted to explore the implications for the future of Apex in this space.
1. As the JQM gallery shows, building browser-based mobile apps is a feasible approach, performance is acceptable but functionality is limited. JQM provides the basic form/list widgets but native apps provide a much richer experience, better user interaction widgets and can access local device features like GPS, camera, accelerometer, address book, etc. Apex/JQM, out-of-the-box, cannot do this.
2. The PhoneGap framework (recently acquired by Adobe) is interesting in that it takes a web page (HTML(5), Javascript, CSS) and wraps it in device-specific APIs to produce native apps that can be deployed in the vendor's "app store". It also provides a API to access the device features mentioned above. Given that all Apex pages are produced by the Oracle database engine, I am guessing it is not possible for Apex to integrate with frameworks like these. Is that an accurate statement?
3. So, as far as Apex is concerned, the only viable option is to build URL-accessible mobile websites which rely on the JQM library to render device-independent content properly on different mobile devices. In this scenario, what are the security options available? Clearly, we would need a Apache/EPG server outside the corporate firewall (poke hole for port 80) to relay traffic to/from the internal database. What about multi-factor authentication, digital certiticates, RSA tokens and all that stuff? How would we go about integrating all this into the Apex authentication scheme? Especially given the additional hop introduced by the proxy server and its impact on passing authentication tokens back and forth.
Comments welcome. Thanks..

Answer 1

Hi VANJ,
Just to clarify a few points about our plans regarding mobile support in Application Express. In APEX 4.1 we've made a number of modifications that make the integration of frameworks such as jQuery Mobile easier. This basically means you have better controls over the HTML rendered by the Application Express engine, which allows you to render the kind of HTML structure required by jQuery Mobile. In APEX 4.2 we plan to further enhance our wizards and themes to make the wizard-driven generation of jQuery Mobile pages easier, more automated. But of course you can use APEX 4.1 today to build jQuery Mobile based applications, you would have to either bundle the jQuery Mobile libraries, or reference the libraries online. In APEX 4.2, or perhaps even in an upcoming APEX 4.1.x patch, we'd like to include these files in our distribution.
Now regarding native vs. web-based apps, of course there are always advantages in building native apps (performance, access to device-specific features, etc), just like there are advantages in using mobile web apps (build once, run on any device, one code base, familiar languages like HTML, CSS, JavaScript etc). So it really depends on what kind of app you're building. There are certainly use-cases for both approaches. However APEX is a tool to develop web applications, so you won't be able to use this for native apps. I haven't done much with PhoneGap yet, but I would expect some benefits in using this with APEX, like placing an app icon in your menu, locally storing files like images, JavaScript and CSS.
As your security questions, that would again depend on what you're trying to build. If you're just building a mobile version of your companies website, this should be open to the public, perhaps with some regular sign-in for protected pages, using APEX authentication, LDAP, or other authentication methods. If you're building more secure apps, accessing internal resources, using VPN to access your internal network might be an option.
Regards,
Marc