Pega Web Mashup and URL Encryption.
Hello All,
While working on launching Pega mashup from Salesforce one point which i need some advice is encryption.
I have gone through below url regarding it but seems platform support team in the company is not ok with setting <env name="initialization/SubmitObfuscatedURL" value="optional"/> instead of required.
https://community1.pega.com/support-articles/pega-web-mashup-does-not-load-enabling-url-encryption
I am passing account# in the url and need encryption,please help with some points.
I am on Pega 8.2.2 and integration with Salesforce and in the https log i check for encrypted url.
I need to test for both IE and Chrome and encryption should work for both is the requirement.
Thanks.
***Edited by Moderator Marissa to update platform capability tags****
Pegasystems Inc.
IN
Hi Kapil,
Setting "initialization/urlencryption" enables legacy URLEncryption feature which has many known limitations. In this case, this legacy encryption logic scans the html response and replaces all occurrences of pyactivitypzZZZ=10f7d300080bfae52d20ee510784402899fa3b31ba91125f0269cf526801bd1e11c262090658172b86db950e2c5384731ad8d531b86b1a7b6d213d7d961096852f5963a53e183c00c3e4623f29ccadb9cc6d029dcec83613c0a03b94f37d295bf249aff89e5ad5b717a8b2e5574193692395907f25afba7500d5f8b503049cc1b7dc0e53df4a0729d454b7dd87700a763bec8edac42c7eecf00b3da2bc82686b4550176c78fc30b491d9d7f17866c6456c9aa681d5e3f827378495d63e240c48*'t be encrypted as pyActivity is part of data and not the action.
Hi Kapil,
Setting "initialization/urlencryption" enables legacy URLEncryption feature which has many known limitations. In this case, this legacy encryption logic scans the html response and replaces all occurrences of pyactivitypzZZZ=10f7d300080bfae52d20ee510784402899fa3b31ba91125f0269cf526801bd1e11c262090658172b86db950e2c5384731ad8d531b86b1a7b6d213d7d961096852f5963a53e183c00c3e4623f29ccadb9cc6d029dcec83613c0a03b94f37d295bf249aff89e5ad5b717a8b2e5574193692395907f25afba7500d5f8b503049cc1b7dc0e53df4a0729d454b7dd87700a763bec8edac42c7eecf00b3da2bc82686b4550176c78fc30b491d9d7f17866c6456c9aa681d5e3f827378495d63e240c48*'t be encrypted as pyActivity is part of data and not the action.
Starting 8.1 a new version of URLEncryption is introduced in the platform that is enabled by default. This new version will become active unless "initialization/urlencryption" is explictily set to true. We recommend you to set "initialization/urlencryption" to false so that the new version of URLEncryption becomes active. New URLEncryption uses a robust encryption mechanism with dynamic key generation for each thread so that only legitimate requests can debug the encrypted text.
Could you please try the use-case after switching to newer version of URLEncryption that is enabled by default in the platform by setting below Dynamic System setting followed by node restart
| Ruleset | Setting Name | Value |
|---|---|---|
| Pega-Engine | prconfig/initialization/urlencryption/default | false |
Hope this helps.
Regards,
Mounika
Pegasystems Inc.
US
This note is to clarify the above statement regarding URL Encryption in 8.X versions:
The new form of URLEncryption began with the release of 8.3 and more functionality will be added in subsequent patch and full releases. This uses pzuiactionzzz as the query string parameter instead of pyActivity. Eventually, this will replace the legacy form of URL Encryption.
The legacy form of URL Encryption uses the settings <env name="initialization/urlencryption" value="true" /> and <env name="initialization/SubmitObfuscatedURL" value="required" /> and are still valid in 8.x, however this is still not supported in dev studio and there is no plan to make any changes here. This uses the parameter name pyactivitypzZZZ to replace pyActivity