Security: Shortcuts [editor]

Shortcuts

In a production environment only shortcuts should be used. By default, all exposed flows can be started. Please read Create a shortcut in the Java Runtime on how to create a shortcut. Disabling starting all exposed flows can be done by setting the blueriq.production.shortcuts-only to true in application.properties.

AQ_StartProject

By default shortcuts can be accessed externally via the url (e.q. http://localhost:91/Runtime/server/start/<SHORTCUT_NAME>). When using shortcuts in combination with AQ_StartProject you should be aware that this shortcut can also be accessed externally. To prevent this for happening you should set the property privateAccess to true (e.q. (blueriq.shortcut.[name].privateAccess=true). The reason for this is that via the AQ_StartProject parameters are passed to the shortcut application and are picked up via the AQ_GetRequestParameters service. The AQ_GetRequestParametersdoes not distinguish how parameters are send. For more information about the way parameters are send via the AQ_StartProject, please read AQ_StartProject#Security.

Example shortcut in application.properties:

blueriq.shortcut.<SHORTCUT_NAME>.flow=<FLOW>
blueriq.shortcut.<SHORTCUT_NAME>.languageCode=<LANGUAGE>
blueriq.shortcut.<SHORTCUT_NAME>.project=<PROJECT>
blueriq.shortcut.<SHORTCUT_NAME>.theme=<THEME>
blueriq.shortcut.<SHORTCUT_NAME>.ui=<MVC>
blueriq.shortcut.<SHORTCUT_NAME>.version=<VERSION>
blueriq.shortcut.<SHORTCUT_NAME>.privateAccess=true

AQ_GetRequestParameters

 The AQ_GetRequestParameters service is able to retrieve parameters from the URL. You should treat these parameters as "dirty", which means you should validate if these parameters before using them.