Question
E-Pragati
IN
Last activity: 15 Sep 2020 7:34 EDT
Sensitive data in URL
The application page contains a form with a password field. This form submits user data using the GET method; therefore the contents of the password field will appear in the URL. Sensitive information should not be passed via the URL. URLs could be logged or leaked via the referrer header.
need solution in Pega level.
***Edited by Moderator: Pallavi to update platform capability tags***
Updated: 30 Jul 2020 0:30 EDT
Maantic Inc
US
Hi, Are you referring pega UI form? Can you elaborate more about form where you are calling the GET method?
Updated: 30 Jul 2020 0:58 EDT
E-Pragati
IN
Hi John,
No, that is the authentication html form which I have attached screenshot(Capture.jpg) and attached error screenshot(Capture1.jpg) as well.
Capture1.JPG
They don't want to display aadhar number . ie the error.
how to hide that Aadhar number ?
Capture attachment :
In that form they have used post method, they have recommended post method to resolve the issue.
but in Capture1 screenshot it is showing GET method. How it will come ?
Thank you in Advance.
Updated: 30 Jul 2020 9:37 EDT
Pegasystems Inc.
IN
In normal pega form will do a post and will never do a get request.
From the image attachment i could see aadhar number is sent in /Get request for URL?pyActivity="Code-Security.-pzGeneratCaptcha" and it will be used only when you try to get a new captcha image ... either when u enter wrong credentials and do a submit or when u request for a new captcha image as pega downloads the image via the url response
In both the scenarios no sensitive information will be sent (Only current time will be sent in the url)
can you check the customization if any done for "Web-Login" HTML Rule ?