Issue

Traditional UI in Constellation (Blended UI) landing page fail for end users with HTTP 400 errors.  

Symptoms and Impact

Users experience one or more of the following: 

1. A custom landing page built using the Traditional UI in Constellation (Blended UI) approach fails to load for business or end users and displays an HTTP 400 Bad Request error in the browser. 
2. The same landing page loads correctly for administrator users in the same environment. 
3. The issue is environment-specific — it does not reproduce in development, QA, or production-mirror environments, only in Production. 
4. The landing page remains in a loading state indefinitely after the HTTP 400 is resolved (secondary symptom — see Scenario 2 below). 
5. User privileges have been reviewed and appear correctly configured. 

Environment Conditions

The following are present when this issue occurs: 

• The application uses the Traditional UI in Constellation (Blended UI / Coexistence) pattern to render landing pages inside a Constellation portal. 
• The Dynamic System Setting (DSS) initialization/submitobfuscatedurl is set to required in the affected environment. 
• The DSS initialization/urlencryption is set to true in the affected environment. 
• The same DSS values are not consistently applied across all environments, creating a configuration mismatch between Production and lower environments. 

Root Cause

Scenario 1 — HTTP 400 Bad Request 

The Traditional-in-Constellation feature generates and submits clear-text (non-obfuscated) pyActivity URL requests as part of the !Coexist request flow when rendering a Traditional UI landing page embedded within a Constellation portal. When the DSS initialization/submitobfuscatedurl is set to required, the Pega Platform enforces that all submitted URLs must be in an obfuscated format.  

Because the Blended UI framework submits these requests in clear-text format, the server rejects them before the doUIAction execution can complete, resulting in HTTP 400 errors. 

This behavior is specific to business and end users because the failure occurs at the URL-obfuscation validation layer, which is triggered differently for non-administrative operators. Administrator users are not affected due to differences in how their requests are processed or validated in the same environment. 

Scenario 2 — Page Remains in Infinite Loading State (after Scenario 1 is resolved) 

After setting initialization/submitobfuscatedurl to optional, if initialization/urlencryption remains set to true, an HTTP 303 redirect succeeds but the page continues to load indefinitely. This occurs because the generated mashup JavaScript is corrupted by the legacy URL-obfuscation processing that is still active when urlencryption=true. Setting initialization/urlencryption to false resolves this secondary failure. 

​​​​

Steps to Reproduce 

The following steps reproduce the HTTP 400 failure when initialization/submitobfuscatedurl is set to required and initialization/urlencryption is set to true. 

Prerequisites: 

1. You have a Constellation application with the Traditional UI in Constellation (Blended UI) feature enabled. 
2. The DSS initialization/submitobfuscatedurl is set to required in the target environment. 
3. The DSS initialization/urlencryption is set to true in the target environment. 

Steps: 

1. In the header of Pega Infinity™ Studio, click the name of your application, and then click View application rule. 
2. In the Advanced section, verify that Pega Platform (Traditional UI) and Use Constellation UI to render landing pages are enabled. 
3. In App Studio, in the left navigation panel, click Settings, and then click Traditional UI in Constellation. 
4. Create and configure a landing page asset. Click Generate to generate the asset. 
5. In the Constellation portal navigation settings, add the generated landing page to a Constellation portal. 
6. Log out of the application. 
7. Log in as a business or end user (non-administrator operator) and navigate to the Constellation portal where the landing page was added. 
   • Expected result: The landing page loads successfully. 
   • Actual result: The page fails to load and displays an HTTP 400 Bad Request error. The landing page loads correctly when accessed as an administrator user.

Solution

Apply the following DSS configuration changes in the affected environment. Both settings must be updated together to fully resolve the issue. 

Step 1 — Update the submitobfuscatedurl DSS 

Change the value of initialization/submitobfuscatedurl from required to optional. This allows the Pega Platform to accept both obfuscated and clear-text URL formats, enabling the Traditional-in-Constellation landing page requests to complete successfully. 

This change can be applied using either of the following methods: 

1. Via Dynamic System Settings (DSS): In the Pega administrative interface, search for the DSS initialization/submitobfuscatedurl and update the value to optional. 
2. Via prconfig.xml: Update the corresponding parameter initialization/submitobfuscatedurl in the prconfig.xml configuration file to optional. 

Step 2 — Update the urlencryption DSS 

Change the value of initialization/urlencryption from true to false. This resolves the secondary infinite-loading failure caused by corrupted mashup JavaScript generation that occurs when URL-obfuscation processing remains active. 

This change can be applied using either of the following methods: 

1. Via DSS: Search for initialization/urlencryption and update the value to false. 
2. Via prconfig.xml: Update the corresponding parameter in prconfig.xml to false. 

Step 3 — Restart the application server 

After applying both configuration changes, restart the application server for the settings to take effect. 

Step 4  — Regenerate assets and clean up ruleset data (optional) 

If coexistence wizard data was incorrectly stored within a production ruleset, perform the following additional steps: 

1. Delete the production rulesets containing the incorrectly stored coexistence wizard data. 
2. In App Studio, click Settings, and then click Traditional UI in Constellation. 
3. Regenerate the landing page assets to ensure the coexistence pages are correctly built and available for end-user access groups. 
4. Restart the server again after regeneration. 

Verification 

After applying the configuration changes and restarting the server: 

1. Log in as a business or end user (non-administrator). 
2. Navigate to the Constellation portal containing the Traditional UI landing page. 
3. Confirm that the landing page loads without an HTTP 400 error and without remaining in an infinite loading state. 
4. Confirm that the landing page is accessible across all affected user access groups. 

Prevention 

1. Establish a routine process to compare DSS configurations, including initialization/submitobfuscatedurl and initialization/urlencryption, across all environments (development, QA, production mirror, and production) to detect mismatches before deployment. 
2. Include URL-obfuscation and security configuration parity checks as part of the pre-production deployment checklist. 
3. Ensure functional testing in all environments covers both administrator and non-administrator (business) user roles, as environment-specific security settings may behave differently depending on the user access level. 
4. Coexistence wizard data must not be stored within production rulesets. Validate ruleset placement as part of the pre-promotion checklist for Blended UI implementations. 

References

Identifying your Constellation adoption strategy 

Using Constellation in existing applications 

Constellation in traditional UI 

Enabling coexistence