Getting 403 Forbidden when trying to run activity from user portal

Blueprint and App Design
, ,
1

In the user portal, as a non-admin user, I’m getting this error when trying to run an activity with JavaScript:

var urlString = new SafeURL(‘@baseclass.ShowLogoffTimerRTS’);

window.open(urlString.toURL(), null);

The activity has the “Require authentication to run” checkbox unchecked and the “Allow direct invocation from the client or a service” is checked.

I noted that this is only happing for a non-admin user, because I can run this script successfully using my admin access group.

Thanks in advance to anyone who spends time on this.

Grant

2

@grant@VA

Hello,

does the popup come? or it fails for the content of the popup?

I guess the content will be executed/created with the user context and this might require some grants also

Is it the same with a static content for the popup?

Regards

Anthony

3

@grant@VA I am not sure why @baseclass.ShowLogoffTimer (it’s available) can’t be use for any customization required as per application.

Basically follow below steps:

  1. Modify @baseclass.ShowLogoffTimer as per need in application rule-set

  2. This activity is being referred in webwb.pega_desktop_AppControllerLite.js … in the link/button in Action tab of configuration panel, use RunScript and refer this.

Hopefully it will work.

4

@Anthony_Gourtay Thanks for the reply. No, the popup does not appear. If I’m using static content for the popup contents there is no issue. I can see the server responding with a 403 error associated with the request to call the ShowLogOffTimer activity.

5

@SachinA48 Yes, we are originally seeing the 403 response with this implementation of the pxSessionTimer. I had create my own modal dialog b/c the server call to run @baseclass.ShowLogoffTimer activity from the desktop_showTimeoutWarning JS function was returning 403. Also we are noticing 403 responses for some JavaScript API calls, like pega.api.ui.actions.runDataTransform. Thanks for the reply.

6

@grant@VA , are you hitting newer Javascript security functionality? As a quick test, set pyBlockUnregisteredRequests to false in a private checkout. If you find success, you’ll need to use encryption to your Javascript in addition to SafeURL. See pega_rules_utilities.pzEncryptURLActionString