Question
Tech Mahindra
CA
Last activity: 1 Dec 2016 17:16 EST
Can SafeURL be encrypted to avaoid security issues?
We are using 6.1 SP2. We are calling SafeURL from javascript to call an activity with parameters but security team got the issue with this approach as parameters in URL be updated and able to retrieve the results with modified parameters in URL.
Is there any way this URL can be encrypted?
Pegasystems Inc.
IN
Hi Naveen,
I believe you can encode/encrypt the SafeURL using the safeurl functions. such as toEncryptedURL().
Please refer to the help at 
> APIs > Desktop > Safe URL.
Tech Mahindra
CA
When i tried with toEncryptedURL method, i could able to access the parameters through fiddler. My requirement is to stop middle man attacks i.e., intercepting request and re-post request with different parameters from client side. is there any way to achieve it?
Pegasystems Inc.
US
You can take a look at this article for setting up url encryption: https://community.pega.com/support-articles/url-obfuscation-setting-causes-dev-portal-not-open. The caveat as the article explains is that it is not supported with the developer portal.