Clarification needed on some of the prconfig security settings.
Hello All,
Currently, We are in a process of implementing "prconfig security settings" . While doing so, we had doubts on some specific settings. Could anyone please provide some clarification on those.
PFA the pdf document about the doubtfull settings and the corresponding questions.
Infra : Pega Cloud 8.2.3
We have used below link to compare the security settings with the prconfig and DSS settings available in our infra.
https://community.pega.com/knowledgebase/articles/security-settings-prconfigxml-file
Thanks in advance!
Pegasystems Inc.
US
I did not see the Pega version here. Can you please clarify? Also is this an on-prem or Pegacloud env?
ING
NL
Hi Kevin,
Thanks for checking! I missed to mention the version indeed, which I have corrected now.
The infra is in Pega cloud 8.2.3
Pegasystems Inc.
US
Hi KingShuk,
I would suggest opening an SR to have these settings reviewed in the context of your questions. Once you open an SR, please respond here with the SR number.
ING
NL
Hi...Thanks for your reply! I will do the same as you have suggested.
ING
NL
Hello, we have raised SR-D71795 for this purpose.
Proximus
BE
We're not on PEGA cloud and we validated security requirements with below setup on 7.3.1
<env name="authentication/trojanhorseprotection/default" value="1"/>
<env name="HTTP/UseNoCacheHeaders" value="true"/>
<env name="cookie/HttpOnly" value="true"/>
<env name="HTTP/SetSecureCookie" value="false"/>
<env name="initialization/DisplayExceptionTraceback" value="false"/>
<env name="initialization/ErrorOnInvalidThreadName" value="true"/>
<env name="initialization/DisableAutoComplete" value="true"/>
<env name="initialization/PromoteEmbeddedPortals" value="true"/>
Our Pega apps are internal and not Internet exposed.
SetSecureCookie to true was creating issue on our side, so we kept it to False.
If this can help...
Regards
Anthony
ING
NL
Hi Anthony, Thanks for your reply. Could you please bgive some more information on the issues you faced with SetSecureCookie? Thanks in advance!
Proximus
BE
If I remember well, application was not coming up with SetSecureCookie on true
I think that you need to be 100% https to use this param on True (to be confirmed)
You could either directly try it with True and see what's happening or keep this one on False while you play with other params. When you've found a setup fine for you, then turn this last one to True.
Regards
Anthony
Pegasystems Inc.
US
Hi,
If SetSecureCookie is enabled and you try to access the Pega Application via http://... you will fail. This setting forces you to access only via https://...