Hello Maks.
Not that I'm against using e-mail, however I think it's more resourceful if we keep the discussion opened for whoever has interest on participating. We could use the community forum as a start point and as the project expands into something solid we migrate to a github issue.

• The ideal world between React and Angular.
• Better documentation.
• Easy to learn, not hard to master.
• Highly flexible.
• Simple syntax.
   

In-depth comparison.
Note that I'm not saying what one has that other misses, I'm just exposing its strong points.

why didn't someone else think of this before?

As far as I know, VueJS uses property accessors to ovewrite set/get behavior. When AngularJS came out there wasn't an estabilished way of reproducing that, so who takes the blame here was the slower JavaScript development, untill ECMAScript 5 came out. Mostly because IE of course.

When you're doing this without a sponsor and part time it's a long hard road...

Have you ever heard about Open Collective?

This is one of the reasons that I asked to bring some highlight to tutorials, since most of tutorials are related to community efforts or newer ISC technologies.

I think the community as a whole take some blame as well. Since Caché is robust enough to make us think  that we can only use features provided and audited by ISC themselves., you can see that when comparing the number of questions with articles/anouncements. 
So far, my impressions are that most of Caché developers prefer to take the safest route instead of trying what the community provides. There're exceptional projects as well, like WebTerminal but such projects still represent a minor part of us using it.
This subsequently results in open-source projects being abandoned due to the lack of interest as user and developer (maintainers). My proof when saying that is the amount of replies and attention a thread that presents a new project gets.
Also, if you don't want to lose time trying to convince your boss about open-sourcing a tool, do it outside and bring it to where you work. This way you'll be able to say that the project is your initiative and not something on behalf of the company you work. Just remember to design it in a way that won't use any business code.

Nope! Click on the check right before the "ANSWER" and you'll mark this answer as accepted. Remember that only you, the OP, can do it!

Accepting answers will move the answers counter up!

This way you don't even need to reply with a thanks, as we consider checking an answer and upvoting a post the same as that.

Hello Evgeny! Got it!
I'll leave it here.

And he goes and creates another one...

Kyle, https://community.intersystems.com/post/extract-string-value

Whoops.
I meant this one.

Broken link.
EDIT: There's a space in the end of your link.

Does accessing the login page creates a session and uses a license? Or only after authenticated?

That's the issue. You can't read any new environment variables after the Caché/Ensemble process (by that I meant at OS level, using a shell script) has been started. Not even Docker allows you to do that, since you must rebuild the container to "refresh" the variables. Otherwise that would be a security flaw as @Stefano Cairoli pointed out.

If you own the code, you can try simulating env variables by using globals, which is exactly the same thing the class Sample.Installer does or populate it from an external file, like a .env. Also $zf won't work because it always summons a new shell to execute your call, so even though the variables you set would be available there, it won't be there for your current process (again, OS level).

@Eduard Lebedyuk no, this is a misconception. In a nutshell CORS is the opposite, by default every green browser will apply the Same Origin Policy to allow or negate the access. However CORS has been made for making that policy lax (since it allow you to access a resource outside the origin's domain). 
Needless to say, this wouldn't prevent the attacker from GET'ing a resource because GET methods don't execute a pre-flight request, and that's just the tip of the iceberg, you can read more about it here:
About the misconception https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/september/common-csrf-prevention-misconceptions/
About the correct implementation https://www.acunetix.com/websitesecurity/csrf-attacks/

Btw, this implementation doesn't validate the token, neither it generates something randomically strong (using CPRNG). Checking if the header is present  is not enough. OWASP advises you to generate tokens that you can validate. It also suggests that the implementation should use stateful URLs, like the ones containing the token themselves (which is similar to the CSPToken that each private CSP page has).

Which have been broken already:

https://shattered.io/

Also. NIST considers SHA-1 as obsolete since 2011. SHA-256 is somewhat safer for now.

We have some customer projects that uses a separate user table, in these cases we usually use a stronger hash implementation:

Method SetPassword(value As %String) As %Status
{
  set i%password = ..HashPassword(value)
  return $$$OK
}

ClassMethod HashPassword(
	value As %String,
	salt As %String = "") As %String
{
  if salt = "" {
    set salt = $$$lcase(##class(%xsd.hexBinary).LogicalToXSD($System.Encryption.GenCryptRand(32)))
  }
  
  set hash = $$$lcase(##class(%xsd.hexBinary).LogicalToXSD($System.Encryption.PBKDF2(value, 15000, salt,256,256)))
  return $$$FormatText(hash_":"_salt)
}

Method IsPasswordMatch(plainTextPassword As %String) As %Boolean
{
  set salt = $piece(..password, ":", 2)
  return $$ConstantTimeCompare(..HashPassword(plainTextPassword, salt), ..password)
  
ConstantTimeCompare(a, b)
  if $length(a) '= $length(b) return 0
  for i=1:1:$length(a) {
    // Convert char to ASCII code and then to bitstring.
    set aChar = $factor($ascii($extract(a, i)))
    set bChar = $factor($ascii($extract(b, i)))
    set match = $bitlogic(aChar ^ bChar)
    set all = $bitlogic(all | match)
  }
  // 00000000 = valid
  return $bitfind(all, 1) = 0
}