Getting 403 Forbidden when trying to run activity from user portal
In the user portal, as a non-admin user, I'm getting this error when trying to run an activity with JavaScript:
var urlString = new SafeURL('@baseclass.ShowLogoffTimerRTS');
window.open(urlString.toURL(), null);
The activity has the "Require authentication to run" checkbox unchecked and the "Allow direct invocation from the client or a service" is checked.
I noted that this is only happing for a non-admin user, because I can run this script successfully using my admin access group.
Thanks in advance to anyone who spends time on this.
Grant
Proximus
BE
@Grant@VA
Hello,
does the popup come? or it fails for the content of the popup?
I guess the content will be executed/created with the user context and this might require some grants also
Is it the same with a static content for the popup?
Regards
Anthony
Favor TechConsulting LLC
US
@Anthony_Gourtay Thanks for the reply. No, the popup does not appear. If I'm using static content for the popup contents there is no issue. I can see the server responding with a 403 error associated with the request to call the ShowLogOffTimer activity.
Capgemini
IN
@Grant@VA I am not sure why @baseclass.ShowLogoffTimer (it's available) can't be use for any customization required as per application.
Basically follow below steps:
1. Modify @baseclass.ShowLogoffTimer as per need in application rule-set
2. This activity is being referred in webwb.pega_desktop_AppControllerLite.js ... in the link/button in Action tab of configuration panel, use RunScript and refer this.
Hopefully it will work.
Favor TechConsulting LLC
US
@Sachin Agrawal Yes, we are originally seeing the 403 response with this implementation of the pxSessionTimer. I had create my own modal dialog b/c the server call to run @baseclass.ShowLogoffTimer activity from the desktop_showTimeoutWarning JS function was returning 403. Also we are noticing 403 responses for some JavaScript API calls, like pega.api.ui.actions.runDataTransform. Thanks for the reply.
Jabil
US
@Grant@VA, are you hitting newer Javascript security functionality? As a quick test, set pyBlockUnregisteredRequests to false in a private checkout. If you find success, you'll need to use encryption to your Javascript in addition to SafeURL. See pega_rules_utilities.pzEncryptURLActionString