Question
Oligos SAS
FR
Last activity: 28 Jun 2022 8:46 EDT
random 403 on ResetNotificationMessageCounter while pzRunActionWrapper is called from DoClose / removeThread /reloadSect
Hello
Pega set the cross site reference forgery in your application. To achive that, many activities are declared in the CPMInteractionHeader section. The hidden control on that section hold a script event that is declaring activity that needed to be executed from client side.
But even with that we are still observing a lot of random SECU0019 alert on PDC eg :
Unauthorized request detected : Unregistered request encountered with params pyActivity:pzRunActionWrapper pySubAction:runAct pzActivity:Work-.ResetNotificationMessageCounter
Does anyone have any insight on what might cause the error to popup ?
regards
Stéphane
***Edited by Moderator Marije to add Capability tags***
Pegasystems Inc.
GB
These warnings are observed due to BAC validation.
To identify the rules that you need to configure, see Identifying the custom controls to configure.
All the unregistered activities noticed in SECU0019 alerts need to registered/encrypted to prevent BAC issue.
As a workaround, disable 'pyShowSecureWarningFeature' and 'pyBlockUnregisteredRequests' when rules to avoid BAC issues.
If we set the pyBlockUnregisteredRequests when rule as False then this issue is not occuring, but in this way, we are suppressing the access violation issues instead of fixing the issues.
We recommend you to fix the behavior of the non-autogenerated control that invokes the specified activity.
There are three ways to register the rule or encrypt the URL to prevent this alert from being logged, depending on the rule type.
These warnings are observed due to BAC validation.
To identify the rules that you need to configure, see Identifying the custom controls to configure.
All the unregistered activities noticed in SECU0019 alerts need to registered/encrypted to prevent BAC issue.
As a workaround, disable 'pyShowSecureWarningFeature' and 'pyBlockUnregisteredRequests' when rules to avoid BAC issues.
If we set the pyBlockUnregisteredRequests when rule as False then this issue is not occuring, but in this way, we are suppressing the access violation issues instead of fixing the issues.
We recommend you to fix the behavior of the non-autogenerated control that invokes the specified activity.
There are three ways to register the rule or encrypt the URL to prevent this alert from being logged, depending on the rule type.
- Configuring the custom control by using the rule form — Use the rule form when a control such as a button calls the Run Script action, which in turn calls a custom function.
- Configuring the custom control by encrypting the URL in JavaScript — Use JavaScript when you cannot use the rule form and your control calls custom JavaScript.
- Configuring the custom control by registering the action page in Java — Use Java when your control calls a custom rule (other than a function) and you do not have access to JavaScript.
Can you please do the registration for the SetOtherRadioToFalse and ResetNotificationMessageCounter activities in the UserWorkForm then verify the reported behavior?
You may need to log a support incident if the network trace and logs do not provide any further help after you have carried out these further tests.
Oligos SAS
FR
Hello, thanks for the answer.
At the moment we manage to identify that 2 identicals requests are sent at the same time (microsec delay) and the latest one is getting rejected. We have not find the reason. But it is link to a click action : doclose / removethread / reloadsection...
For a quick solution, I' ll declare the guilty activity in the cross site request forgery (configure>system>settings>cross site request forgery) and see if the random SECU0019 are still displaying in PDC.
I also find a recent discussion on the subject, another hint maybe also an interaction with pegaknowledge widget on the V360.
Regards
Stéphane