INC-156647 · Issue 626292
Improved disconnected requestor cleanup for FieldService
Resolved in Pega Version 8.4.5
A large number of requestors from FieldService with the status as 'Disconnected' were accumulating and causing performance issues. This was traced to the requestors not getting passivated due to users not logging out and new requestors being created for the same users next time, and was caused by the value of the DSS Initialization/PersistRequestor being set as "OnTimeout". When the DSS prconfig/timeout/browser/default is not configured, the default browser requestor timeout is 60 minutes. In this scenario, requestors were not passivating as the requestor passivation timeout was set to the refresh token lifetime for mobile users, which was very large and overwrote the DSS value. This has been resolved by removing the code which set the passivation timeout to the OAuth2 refresh token lifetime.
INC-158720 · Issue 633990
Handling added for obfuscation stale requestor error
Resolved in Pega Version 8.4.5
When an environment was configured with URL encryption (initialization/UREncryption) set to true and the Authentication Service OPENID had a POST authentication activity which set pyAuthenticationPolicyResult to false, a blue screen error was seen with the exception "Obfuscation cannot be performed with a null or blank key". This was traced to the system trying to fetch the secureFeaturesForURLTampering property from staleRequestorrequestor object when the object had already been destroyed. This has been resolved by adding additional handling for the staleRequestorError.
INC-161260 · Issue 634050
Enhanced logging for CBAC policies
Resolved in Pega Version 8.4.5
Additional logs have been added to assist in easier debugging of any configuration issues with CBAC policies.
INC-163226 · Issue 632964
Alert resolved for query parameter in non-standard format
Resolved in Pega Version 8.4.5
A failure status occurred during refresh of an optimized grid section. Investigation showed this was caused by a parameterized datapage being used as a source for a section that passed a query parameter in a non-standard format. There was no functional impact, and the alert has been resolved by setting the system to call StreamParameter extraction only if the rejectTamperedRequests DSS is explicitly set to true.
INC-169186 · Issue 655539
Disconnect button availability extended
Resolved in Pega Version 8.4.5
A case was not refreshing when the disconnect button was selected while using the standard section for authorization grant type authentication. This was traced to a query executed to find a div with attribute pzInsHandle, but that attribute was not applicable in the user portal. To support this use, the query has been extended to be applicable for user portal (attribute data-ui-meta) and Dev Studio landing page.
INC-170423 · Issue 648982
Added catch for SAML WebSSO duplicate key exception
Resolved in Pega Version 8.4.5
After logging in from SSO, closing the Pega window and opening it again resulted in the error "Unable to process the SAML WebSSO request : Violation of PRIMARY KEY constraint. Cannot insert duplicate key in object." This has been resolved by updating the session index handling and adding a catch for the duplicate key exception.
INC-171838 · Issue 651438
Added mail/telephone link to allowed CSP child frame
Resolved in Pega Version 8.4.5
After upgrade from v8.3 to v8.5, clicking on the mail / telephone link in the out of the box case participants gadget generated the Content Security Policy error "This content is blocked. Contact the site owner to fix the issue." Examination of the browser dev-tools console indicated the object refused to frame because it violated the Content Security Policy directive: "frame-src *". This behavior was specific to the Google Chrome browser, and has been resolved by adding code so the mailto: and tel: will be added to the frame-src when Data is selected under Child Frame-Source option. Unchecking the Data checkbox for Child Frame-Source on the policy landing page will remove these from allowed actions under CSP.
INC-171875 · Issue 653894
Skip restored for browser request CSRF token
Resolved in Pega Version 8.4.5
Many SECU0008 alerts were seen in the production logs. This was the result of a CSRF token check on requests without pyActivity or pyStream, and has been resolved by restoring a conditional skip of the check as those other browser requests do not contain a CSRF token.
INC-135849 · Issue 582939
Encrypted SOAP response token generation updated
Resolved in Pega Version 8.5.1
After configuring a SOAP service that used signature and encryption on the response, the response being created was incorrect and could not be decrypted by the receiver. Investigation showed that the API used to generate the SOAP headers was not setting the wsse11:TokenType element, causing receivers which enforce BSP compliance to fail. This has been resolved by modifying the custom webservices-rt-pega2 jar to set the token type in the case of a response encryption policy.
INC-138354 · Issue 584722
Handling added for samesite cookies with httpOnly
Resolved in Pega Version 8.5.1
After enabling samesite cookies on Google Chrome to support Mashup login, intermittent issues were seen with a non-mashup login where entering the OperatorID and password only resulted in a refresh of the login screen. This was traced to a scenario where an httponly cookie attribute was present along with samesite cookie attributes, and has been resolved by adding handling for a condition where samesite is set and httpOnly is enabled.