Question
Merkle
ES
Last activity: 19 Oct 2017 16:31 EDT
Web Mash Up Reccomended to still use Gateway?
Hi,
I know from Pega 7.2.1 onwards the gateway no longer needs to be installed for Web Mash Up, but that backwards compatibility still exists.
Today I was reading a white paper published on web mash up: https://www.pega.com/system/files/docs/2017/Oct/Power%20Seamless%20Service%20WP%209.28.pdf
This is only a week old.
It was saying that despite not needing the gateway, that the gateway was still the recommended approach.
"
|
Security exposure (cross-site scripting) |
|
"
Can someone please explain this to me? As deploying and configuring the gateway ect is going to be significantly more effort, and I want to make sure it is worth it. What is the consequence of not using the gateway?
Pegasystems Inc.
US
I will try and find the owner of that document and get it changed or clarified further.
The PRGateway is not needed with 7.2.1 + as we have implemented window.postMessage and is secured with in the application record the Integration/Security tab in a section called Mashup Security. Together with content security, same tab of the application record, cross site scripting exposure is negated.
Note:
A reverse proxy is still not a bad idea though as it can help with Mashup security in general when it comes to secured sites. With a reverse proxy the PRPC content is served through that same host as the top level application making it so authentication to the top level is required to get to the PRPC content.