Verifying requests when using custom controls
Pega Platform protects access to information in your application by using role-based settings and access control policies. Pega Platform provides additional request verification when you use autogenerated controls.
To identify the rules that you need to configure, see Identifying the custom controls to configure.
When you see the message "Unregistered request encountered" in the security alert log, you need to fix the behavior of the non-autogenerated control that invokes the specified activity. There are three ways to register the rule or encrypt the URL to prevent this alert from being logged, depending on the rule type.
- Configuring the custom
control by using the rule form — Use the rule form when a control
such as a button calls the
Run Scriptaction, which in turn calls a custom function. - Configuring the custom control by encrypting the URL in JavaScript — Use JavaScript when you cannot use the rule form and your control calls custom JavaScript.
- Configuring the custom control by registering the action page in Java — Use Java when your control calls a custom rule (other than a function) and you do not have access to JavaScript.
- Identifying the custom controls to configure
Pega Platform protects access to information in your application by using role-based settings and access control policies. Pega Platform provides additional request verification when you use autogenerated controls. When your application supports access checking and includes non-autogenerated controls, you need to identify and fix the controls.
- Configuring a custom control by using the rule form
When you see the message "Unregistered request encountered" in the security alert log, you need to fix the behavior of the non-autogenerated control that invokes the specified rule.
- Configuring the custom control by encrypting the URL in JavaScript
When you see the message "Unregistered request encountered" in the security alert log, you need to fix the behavior of the non-autogenerated control that invokes the specified rule. There are various ways to register the rule or encrypt the URL to prevent this alert from being logged. Use JavaScript when you cannot use the rule form and your control calls custom JavaScript.
- Configuring the custom control by registering the action page in Java
When you see the message "Unregistered request encountered" in the security alert log, you need to fix the behavior of the non-autogenerated control that invokes the specified rule. There are various ways to register the rule or encrypt the URL to prevent this alert from being logged. Use Java when your control calls a custom rule (other than a function) and you do not have access to JavaScript.
Previous topic Verify requests at the application layer Next topic Identifying the custom controls to configure