Question
Tech Mahindra
IN
Last activity: 4 Jun 2024 11:47 EDT
getting ‘Access Control Warning’ after 8.8 upgrade
we are getting "Access Control Warning" after 8.8 upgrade.
Note : already change the WHEN rule (pyShowSecureFeatureWarnings = False)
Accepted Solution
Updated: 4 Jun 2024 11:47 EDT
Pegasystems Inc.
IN
@Birupakhya - This error is seen because of Basic Access Control feature, this was introduced in Pega from 8.5 platform version onwards.
Whenever we have any unsecured or unencrypted calls passed from client to server these issue will be seen. This feature will be enabled based upon below three when rules.
pzSecureFeatures - Always set to true for end users and gives SECU0019 alerts in AlertSecurity logs
pyShowSecureFeatureWarning - Shows error message on the screen
pyBlockUnregsiteredRequests - Functionality will be blocked and sometimes will see 403 error on screen.
pyBlockUnregsiteredRequests will take priority when enabled to true and pyShowSecureFeatureWarning behavior will be suppressed.
By default pyBlockUnregsiteredRequests will be set to true and Pega recommendation is also to set to true and fix the problem why its seen.
Below are article covers all the scenarios where we can see these issues : https://docs.pega.com/bundle/platform/page/platform/security/verify-requests-using-custom-controls.html
Eclatprime Digital Private Limited
AU
The 'pyShowSecureFeatureWarnings' rule controls the display of a warning to the end user when an access violation is found. However, changing the rule to 'False' may not always prevent the warning from being displayed. It's important to review the specific access control warning message and investigate the root cause to address it effectively.
Accepted Solution
Updated: 4 Jun 2024 11:47 EDT
Pegasystems Inc.
IN
@Birupakhya - This error is seen because of Basic Access Control feature, this was introduced in Pega from 8.5 platform version onwards.
Whenever we have any unsecured or unencrypted calls passed from client to server these issue will be seen. This feature will be enabled based upon below three when rules.
pzSecureFeatures - Always set to true for end users and gives SECU0019 alerts in AlertSecurity logs
pyShowSecureFeatureWarning - Shows error message on the screen
pyBlockUnregsiteredRequests - Functionality will be blocked and sometimes will see 403 error on screen.
pyBlockUnregsiteredRequests will take priority when enabled to true and pyShowSecureFeatureWarning behavior will be suppressed.
By default pyBlockUnregsiteredRequests will be set to true and Pega recommendation is also to set to true and fix the problem why its seen.
Below are article covers all the scenarios where we can see these issues : https://docs.pega.com/bundle/platform/page/platform/security/verify-requests-using-custom-controls.html