Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Abhishek Anand (Abhishek_Anand)
Barclays UK PLC
AVP- Pega Engineer
Barclays UK PLC
GB
Abhishek_Anand Member since 2015 7 posts
Barclays UK PLC
Posted: Aug 5, 2019
Last activity: Aug 12, 2019
Posted: 5 Aug 2019 11:16 EDT
Last activity: 12 Aug 2019 16:53 EDT
Closed

Pega WebMashup Security concerns

Hi All,

Recently, whilst working with on the banking giants in UK, we were turned down to use the Pega Web Mashup because it uses IFrame and the use of Iframe opens up the security vulnerabilities such as cross-site threats.

Can someone suggest what to do in that scenario?

To see attachments, please log in.
Low-Code App Development
Security
User Experience

Posted: 5 years ago
Posted: 5 Aug 2019 21:36 EDT
Bhavya Tyagi (Bhavya)
Coforge DPA
Senior Technical Lead
Coforge DPA
GB

Hi

Pega does provide methods to over come cross site scripting. Go through the below link for details:

https://community.pega.com/knowledgebase/articles/best-practices-avoid-cross-site-scripting-xss-vulnerabilities

Hope it helps.

 

Regards

Bhavya

To see attachments, please log in.
Posted: 5 years ago
Posted: 12 Aug 2019 16:53 EDT
John Paul Raja Christu Raja (JohnPaulRaja,C)
Maantic Inc
Consultant
Maantic Inc
US

Application restricted with CSRF

Add below DSS to get exception for mashup consumer portal

Pega-Engine 

security/csrf/validreferers

Value : add mash up consumer URL 

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice