Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Max Toedtemeier (Max Toedtemeier) Computershare Lead Pega Developer
Computershare
US
Max Toedtemeier Member since 2018 9 posts
Computershare
Posted: Nov 20, 2019
Last activity: Nov 20, 2019
Posted: 20 Nov 2019 14:02 EST
Last activity: 20 Nov 2019 14:02 EST
Closed

Passing credentials to Pega Authentication via formdata instead of querystring.

We currently use a redirect via one of our other applications to login to pega via SSO using login credentials in querystring. For example
https://companypega.net/prweb/SSOServlet/<sessionhash>/!STANDARD?UserId=12345&UserName=Bob+User&Email= Proprietary information hidden&From=SSOApp&SenderTime=20191001043429&Env=QA&pw=<pwhash>

This was brought up as a security finding during one of our recent audits. We are researching how to move the data from querystring to formdata.

Has anyone attempted this? My test have shown that pega does accept formdata parameters but doesn't seem to map them to anything on the clipboard on temporary pages. I am trying to find any other spot where this might be stored.

To see attachments, please log in.
Low-Code App Development Dev/Designer Studio Security

Related content:

Related content has not currently been identified for this post.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice