Share
Report
1,214Hi together,
i have questions about the general security of sites implemented with portals. We are implementing a kind of registration site which is a little bit complex and requires more than one step. We can not use advanced forms and use basic forms and pass the id of the data which is just edited from page to page with a get-parameter, so pretty much what everybody would do 🙂
Amongst others, my clients are concerned mostly about the following three things:
- when the url of this process is somehow stolen, another person can work on the same entity just by knowing this id.
In the former version (which was adx with backend code) we just set a cookie in the very first page with a checksum and on each on and every request we could check, whether the request came from the same browser.
I have no idea how to set cookies from PowerApps portals now.
Are there some people out there who also have to make sure, that consecutive requests come from the same browser? How do you achieve that? - We make heavy use of the webapi. This raises also a security issues: a person having know how of portals could just by gussing the attribute names spoil our process, because the api can be used from the console with no problems.
Does anybody have an idea to prevent this? (i think its not possible by design and all websites which make use of their own api have this problem) - Is there any documentation around which describes, whether portals are somehow vulnerable to DenialOfService attacks or other approaches? Is there any documentation around, whether the mechanisms and detections of azure apply to portals as well and the webserver is therefor somehow safe?
Any ideas and thoughts about this topics are highly appreciated
Thanks a lot,
Christian
All responses (
Answers (
