Published Release Notes

Application Express and the Content Security Policy

Application Express copies (if defined) the Content Security Policy (CSP) name (pyContentSecurityPolicyName) from the built-on application in a new application. It also sets the CSP mode (pyContentSecurityPolicyMode) to report. The values appear in the Content Security area on the application rule's Integration & Security tab.

When checking an application in the DCO Compatibility tool, a warning appears if the CSP name is missing.

Offline mobile apps require Dynamic Container to use frameless Single Document mode

You can add a Dynamic Container (DC) directly into a Dynamic Layout cell. When creating a custom mobile app with offline capability, you must use the frameless Single Document mode of DC.

Note that mobile offline capability does not support using a framed Single Document mode.

Password hashing using SHA-256/SHA-512

Password hashing using the SHA-256 and SHA-512 hash functions is available for use during the the Pega 7 authentication process with operator, ruleset, and update lock passwords. The SHA-256/SHA-512 hash functions join the previously available MD5 and SHA-1 hash functions.

Using SHA-256/SHA-512 hashing when creating or upgrading a password hash results in increased complexity of the hash, making it extremely difficult and time-consuming to determine hashed password values stored in a database.

Note that once you have updated your system to Pega 7.1.7 and have applied password hashing using the SHA-256/SHA-512 hash functions, reverting back to a previous version of Pega 7 is not advised as this causes hashed passwords using SHA-256/SHA-512 to fail.

See About password hashing for more information.

Support for OAuth 2.0 authorization code grant type

Pega Platform™ now supports the OAuth 2.0 authorization code grant type, which allows Pega Platform to act as an OAuth 2.0 access token provider for native applications on mobile and other devices. By using the authorization code grant type for mobile clients, you no longer need to implement a variety of standards for various authentication providers. The authorization code grant type also supports the Proof Key for Code Exchange standard (PKCE) for securing public clients.

For more information, see Creating and configuring an OAuth 2.0 client registration.

Use client-based access control to support EU GDPR requirements

You can use client-based access control (CBAC) to satisfy the data privacy requirements of the European Union General Data Protection Regulation (GDPR) and similar regulations. By using client-based access control, you can identify the personal data of clients and automatically process requests to view, update, or remove the data in a secure manner. You can also enforce restrictions on the use of this data in application functions.

For more information, see Client-based access control.

Support for multiple custom mobile apps for a Pega Platform application

To enhance the user experience and provide support for native mobile components, you can create multiple custom mobile apps for a Pega Platform™ application. For each custom mobile app, you must create a different mobile channel interface. In addition, you can configure each custom mobile app to run only in a specific portal for an application. The custom mobile app uses this portal regardless of which default portal is defined for the access group.

For more information, see Selecting a portal for a custom mobile app.

Changes in large data page support in offline-enabled custom mobile apps

You can now create offline-enabled custom mobile apps that store reference data in large data pages that are sourced from report definitions, even if these report definitions return no records. Synchronization of these custom mobile apps does not fail. Also, you can now use page type properties as large data page properties.

For more information, see Creating and sourcing large data pages to store large reference data in offline-enabled applications and Custom populator JavaScript functions for large data pages.

Troubleshooting offline-enabled applications in a browser

You can now troubleshoot offline-enabled applications by using the Tracer tool and developer tools that are available in a web browser. You can troubleshoot scripts that are running when the application is running, without having to use additional debugging tools.

For more information, see Application debugging using the Tracer tool, Troubleshooting offline-enabled applications with the Tracer tool in a browser, and Offline capability.

Support for native search in custom mobile apps

To improve the overall user experience in a custom mobile app, you can configure native search in the user interface of the application. To use the search capability, first configure the pySearchConfiguration rule. This rule allows you to optionally define a set of search categories as a local data source. You then configure the mobile search action for any user interface control, for example, a button in a section. Users can tap the search field to see the most recent search results, including results that are grouped by categories, as they enter search text.

For more information, see Native search capability in custom mobile apps and Configuring search in custom mobile apps.

Enhanced Pulse performance and layout on mobile devices

Pulse performance is now faster on mobile devices. The user interface has been enhanced to enable better collaboration among users. The new Pulse mobile layout provides a better user experience for posting messages, adding attachments, bookmarking content, and so on.

For more information about Pulse, see:

• App Studio – Communicating with users by using Pulse
• Dev Studio – Communicating with users by using Pulse