Hello and welcome to a new OutPower tutorial.
On today's session we are going to talk about security in OutSystems.
We will go through a few pointers that we all should pay attention
and that will help to make our applications more secure.
Let's go check them out.
We start this video, by going over a couple of ways to defend against code injection attacks
and how to enforce a https connection.
To defend against code injection attacks
we can use Content Security Policies, also known as CSP, to minimize that threat.
As for the HTTPS connection,
In a traditional web application, as we are developing we can decide the HTTP security of our flows,
screens or integrations of our application.
But this can be overriden and it is possible to enforce the HTTPS security of applications in our environment.
Both of these configurations can be done in one of two ways. Either through lifetime or via Service Center.
Although in the later versions of the platform this has been pushed from Service center to lifetime only.
If you have LifeTime, you can set the Content Security Policies for all environments or just for one.
Go to the Infrastructure section(Environments) to see all environments.
In an environment, select the Environment Security option.
Now that we are in the security configuration page for the environment,
let's talk a bit about the available options.
Has mentioned before we can set our http security during our development,
but this can be overriden and it is possible to be done for the entire environment , or on a App by App situation.
For all of what we have talked about to work properly a valid SSL certificate is installed in the environment.
Make sure you access your environment using the hostname that matches the SSL certificate's Common Name
or Subject Alternative Name (SAN) when using HTTPS.
If you use a different hostname or just an IP address you will have errors and security warnings.
In a Reactive web or Mobile application, https is always enforced, we do not have the option to disable it.
Enable CSP and Configure directives, with one value per line.
As it was mentioned before we can also configure the CSP for a specific app.
Now let's show how to be able to reach the same security configuration
in Lifetime but for a specific application.
For that we need to go to applications, select an application
followed by clicking on settings.
We can also reach these configurations in Service Center,
but in our specific case we are in a platform version that forces us to do these configs via lifetime.
But the way to reach them is similar if not the same.
So to be able to reach the security configurations for the environment in Service Center
we should do the following.
Go to administration and then select the security tab.
If we wish to apply these configurations to a specific application, we should do this then.
Lets go to Factory and in the applications list lets select our app.
In the app detail screen, select the tab security,
and in there we will have available the options to enforce the HTTPS and to configure our CSPs.
Other security considerations that we can take into account,
are simple best practices that can make a big difference at the end of day.
We should always set the Web Screen's Roles,
this way we do not allow for users to be able to navigate where they do not have permissions
or even worse leave a completely exposed screen with sensitive data available for everyone on the web.
Pay close attention to the information that is passed in the screen parameters,
do not send sensitive information. If necessary encrypt or fetch the data again in the landing screen.
When storing the information in your database,
if you are handling very sensitive information, like passwords or very personal customer information,
we should resort to encrypt that information.
OutSystems has already several possible solutions in the Forge, that can aid us with these functions.
There are many more considerations that should be taken into account,
these are just a few, that could make a difference between the attacker being successful or not.
I hope you have enjoyed our tutorial, so that it can help you build better and more secure applications.
Thank you very much for watching and please join us on our next OutPower tutorial.
Have a good day.