REST Activity Advanced Configuration staging environment

Follow

Tobias

• October 11, 2022 15:22

Hi everyone

Because I use the REST activity a lot and also have to send information through the URL, I have to use the advanced configuration of it. The problems start when I deploy from staging to production. In this case, I have to change the authentication and the URL to production values. The URL can be solved with global variables, but not the authentication. 

Has someone found out an efficient and secure way to solve this problem?

Regards,
Tobias

 

1

• 

  Harish Lakshmana

  • October 11, 2022 18:01

  Tobias, you can use the same Global variable feature for Authorization header value also. It works, I have used it.

  -1

  Comment actions Permalink
• 

  Tobias

  • October 12, 2022 07:13

  Thanks for the reply and this is a solution we considered. The problem is that with this solution everyone who has access to the "Shared Variable" has more or less access to username and password. 

  1

  Comment actions Permalink
• 

  Sam

  • November 30, 2022 18:43

  Hello - We have used this approach for a year and have recently considered it a security risk for the reasons Tobias has mentioned.  Here is a post where Agilepoint suggests a solution.  https://helpdesk.agilepoint.com/hc/en-us/community/posts/8956343073811-Where-do-other-developers-keep-environment-variables-Security-Risk- 

  0

  Comment actions Permalink
• 

  Meenakshi Nadimuthu

  • November 30, 2022 20:21

  Hello Sam, 

  When you edit a Global access token, the password or Client Secret (if you use OAuth) would not be shown to the user (this is already masked). Could you send us a screenshot of where it is displayed? 

  Thanks.

   

   

  0

  Comment actions Permalink
• 

  Sam

  • November 30, 2022 20:32

  Hi Meenakshi Nadimuthu I think there was some misunderstanding.  I am suggesting they use "global access tokens" and not "global variables".  Harish suggested they use the "global variables" and Tobias said that would not work for them.  I was suggesting they use "Global Access Token", as we had a similar issue and that was the solution given in my original post.    

  0

  Comment actions Permalink
• 

  Meenakshi Nadimuthu

  • November 30, 2022 22:58

  Hi Sam, 

  Sorry about the misunderstanding. Thank you for replying to the post. 

  Thanks

  0

  Comment actions Permalink

Please sign in to leave a comment.