Secure connections
What the exam tests
Secure connections cover TLS for browser traffic, certificates, and outbound integrations. The exam checks whether you can keep data encrypted in transit and avoid weakening certificate validation for convenience.
Core rules
- Serve applications over HTTPS with TLS 1.2 or later. Redirect HTTP to HTTPS and use HSTS so browsers do not downgrade.
- In OutSystems Cloud, TLS terminates at the platform edge; custom domains need a valid certificate. In self-managed setups, manage certificates and renewal before expiry.
- Secure Gateway extends the platform to private networks. Treat gateway connections as security boundaries and restrict what is exposed.
- Outbound REST/SOAP integrations must use HTTPS and validate the server certificate. If an internal service uses a private CA, import the CA certificate; do not disable validation.
- Cookies that carry sessions should be Secure and HttpOnly; set SameSite appropriately for your flows.
- Web services that need message-level security should use WS-Security or signed payloads, not just transport encryption.
Worked example
An app calls a payment provider. The developer finds certificate errors in a test environment and disables server certificate validation to make the call work. This is unsafe: it allows a man-in-the-middle to impersonate the provider. Correct fix: install the provider's CA chain, keep validation on, and rotate credentials through secure configuration.
Traps
- Mixed content: an HTTPS page loading HTTP scripts or images.
- Disabling certificate validation just for testing and shipping it.
- Assuming internal network traffic is automatically trusted.
- Forgetting to update callback URLs after enabling HTTPS.