Pega Web Mashup and URL Encryption.

Hello All,

While working on launching Pega mashup from Salesforce one point which i need some advice is encryption.

I have gone through below url regarding it but seems platform support team in the company is not ok with setting <env name="initialization/SubmitObfuscatedURL" value="optional"/> instead of required.

I am passing account# in the url and need encryption,please help with some points.

I am on Pega 8.2.2 and integration with Salesforce and in the https log i check for encrypted url.

I need to test for both IE and Chrome and encryption should work for both is the requirement.


***Edited by Moderator Marissa to update platform capability tags****


Keep up to date on this post and subscribe to comments

September 16, 2019 - 2:22am

Hi Kapil,

Setting "initialization/urlencryption" enables legacy URLEncryption feature which has many known limitations. In this case, this legacy encryption logic scans the html response and replaces all occurrences of pyactivitypzZZZ=10f7d300080bfae52d20ee510784402899fa3b31ba91125f0269cf526801bd1e11c262090658172b86db950e2c5384731ad8d531b86b1a7b6d213d7d961096852f5963a53e183c00c3e4623f29ccadb9cc6d029dcec83613c0a03b94f37d295bf249aff89e5ad5b717a8b2e5574193692395907f25afba7500d5f8b503049cc1b7dc0e53df4a0729d454b7dd87700a763bec8edac42c7eecf00b3da2bc82686b4550176c78fc30b491d9d7f17866c6456c9aa681d5e3f827378495d63e240c48*'t be encrypted as pyActivity is part of data and not the action.

Starting 8.1 a new version of URLEncryption is introduced in the platform that is enabled by default. This new version will become active unless "initialization/urlencryption" is explictily set to true. We recommend you to set "initialization/urlencryption" to false so that the new version of URLEncryption becomes active. New URLEncryption uses a robust encryption mechanism with dynamic key generation for each thread so that only legitimate requests can debug the encrypted text.

Could you please try the use-case after switching to newer version of URLEncryption that is enabled by default in the platform by setting below Dynamic System setting followed by node restart

Ruleset Setting Name Value
Pega-Engine prconfig/initialization/urlencryption/default false

Hope this helps.