OutSystems Security Specialist flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Platform authentication mode

OutSystems-managed authentication where the platform stores users, enforces the password policy, and verifies credentials at login; configured per environment in Service Center.

SAML 2.0 federation

Authentication mode where an external identity provider authenticates users and returns signed assertions; OutSystems validates the signature against the IdP certificate configured in the environment.

Anonymous role

Built-in role automatically assigned to unauthenticated users. A screen allowing only Anonymous is public; a screen with no roles denies access to everyone.

Registered role

Built-in role held by every authenticated end user regardless of custom roles. Useful for screens that any logged-in user may open but anonymous visitors may not.

CheckRole built-in

Server-side function returning whether the current user holds a given role. Used inside actions to enforce authorization that the UI alone cannot guarantee.

Data-level authorization

Filtering aggregates and queries by the current user's identity so users see only their own rows, independent of which screens or roles they can access.

Exposed REST action

A REST endpoint published by a module. It inherits module authentication unless explicitly set to allow anonymous access, which bypasses role checks.

TLS termination point

The component (load balancer or IIS) that decrypts HTTPS traffic. Protocol versions and cipher suites are configured there, not in Service Studio.

HSTS header

Response header instructing browsers to use HTTPS only for a period. Once set, reverting to HTTP is blocked until max-age expires, so enable after verification.

Certificate validation bypass

Disabling certificate checks to accept self-signed or expired certificates in integrations. It removes man-in-the-middle protection and should not be used in production.

Encryption at rest

Protecting stored data via database features such as TDE or Always Encrypted, or field-level encryption through an extension; OutSystems does not encrypt attributes by default.

Password storage rule

Never store raw or reversibly encrypted passwords in entities. Use platform user management or a salted slow hash such as bcrypt or PBKDF2 via an extension.

Secrets in configuration

API keys and connection strings belong in Service Center configuration or an external vault, not in module code or site properties committed to source control.

Log masking

Excluding or obscuring sensitive fields before they reach exception or general logs, since logs may capture request data and are often broadly accessible.

Server-side input validation

Enforcing input rules in actions on the server. Client-side validation is advisory because attackers can bypass the UI and call actions directly.

Output encoding

Encoding user data for its output context (HTML, JavaScript, URL). OutSystems applies built-in encoding, but string-concatenated HTML requires explicit sanitization.

SQL injection prevention

Using aggregates and parameterized queries instead of concatenating user input into SQL strings, which is the main injection vector in OutSystems applications.

Anti-CSRF protection

Default protection on OutSystems screen actions that ties requests to the user session; custom AJAX or exposed endpoints must add their own token or SameSite strategy.

Least privilege accounts

Service and database accounts receive only the permissions the application needs; shared IT accounts and broad admin rights increase blast radius after compromise.

Session variable exposure

Session variables are server-side per-session state, not encrypted, and visible to server-side code; they must not hold raw passwords or API keys.

Custom login override

Replacing the default login screen or flow while keeping the built-in login action as the credential verifier; the override adds checks but does not replace authentication.

MFA via identity provider

Multi-factor authentication for end users is not native to Platform authentication; it is delivered by the external IdP (SAML, Azure AD) or custom login logic.

Environment-scoped role grants

Role membership is stored per environment. Roles granted in Development do not carry to Production, so deployment must include the grants.

Entity CRUD permissions

Per-role Create, Read, Update, Delete permissions on entities, enforced for operations performed through platform-generated actions and permission-aware aggregates.

UI hiding is not control

Hiding a button with an If condition does not protect the action behind it; authorization must be enforced in the action itself.

Back-office HTTPS

Service Center and LifeTime administrative traffic must use HTTPS and be restricted to management networks; public exposure of back-office is a common finding.

Encrypted database connections

Connections from OutSystems to SQL Server or Oracle should be encrypted where supported; connection strings live in Service Center configuration, not source.

IdP certificate expiry

An expired identity provider signing certificate breaks SAML or OIDC login for all users; certificates must be monitored and rotated before expiry.

Secrets in URLs

Placing secrets in query strings exposes them to browser history, proxies, and server logs; sensitive data must travel in headers or bodies over HTTPS.

Data retention policy

Defined lifetimes for personal data, with deletion covering backups and logs, and audit trails of sensitive-data access retained according to policy.

Generic error responses

Showing users a generic message while logging details server-side; stack traces and SQL errors in responses leak internal structure to attackers.

File upload validation

Checking content type and size server-side, storing outside the web root where possible, and never trusting the client-supplied file extension.