Best Practices for Plug-In Modules Implementation

Following general design and development recommendations is the first step in creating high-performance and secure vSphere Web Client extensions. You can then move on to special areas, such as developing HTML-based extension solutions.

Your plug-in package must be OS agnostic. You must avoid reading and writing on the file system from the vSphere Client service layer. In case you need to temporarily store files, you must use the browser cache or your own back-end server.
To provide a consistent end-user experience in case your vSphere Client extension migrates server workloads, make sure that your extension migrates only to vSphere environments that are hosted by a VMware vCloud Air Network Service Provider. For more information about the available service providers, see http://vcloudproviders.vmware.com/find-a-provider.
Avoid using deprecated or private APIs and extension points. Using deprecated APIs in your vSphere Client extensions will prevent them from working with future versions of the vSphere Client.
To prevent performance problems in the vSphere Client and vCenter Server instances, use your Java services only for communication between the vCenter Server instances, or other remote data sources, and the user interface layer. You must not create thread pools in your Java services. Consider implementing any complex business logic in your own backend servers.
Avoid caching data in the Java service layer. Make sure that the vSphere Client remains stateless. To ensure the scalability of the vSphere Client, you must use your backend server to cache data.
To increase the security of your extensions, you must limit the access to your plug-ins to specific users. Use the plugin.xml extension definition to control the user access to your extensions based on their privileges. For example, you can make your extensions available only to users who have privileges to create or delete Datastore objects.
To achieve optimal scalability and performance for your vSphere Client plug-ins, your Java services must not require any significant heap allocation.