Security
What the exam tests
The Security domain tests authentication and authorization design, secure exposure of entities and APIs, input handling, secrets management, and least-privilege administration in OutSystems environments.
Core rules
- Authenticate users through the platform or configured SSO. Authorize with roles, and enforce checks in server-side actions, not only by hiding UI.
- Do not expose entities broadly. Put controlled operations in Service actions, validate input, and return only required fields.
- Use parameterized queries or platform aggregates. Never concatenate user input into SQL.
- Store credentials and keys in secret site properties or the platform secret store, not in code or ordinary site properties.
- Use HTTPS, restrict exposed REST/SOAP methods, and require authentication on APIs unless a documented public contract exists.
- Apply least privilege in Service Center and Lifetime: separate IT users from business users, and limit production deployment rights.
Worked example
A REST API must return customer records. Instead of exposing the Customer entity, create a Service module with a GetCustomer action. The action checks the CustomerManager role, validates the customer identifier, queries only permitted fields, and returns a DTO. Expose only that action. Reasoning: authorization is centralized on the server, over-posting and field leakage are reduced, and the public contract stays stable.
Traps that cost marks
Client-side role checks; exposing entities for speed; hardcoded credentials; granting broad IT roles; missing authorization on service actions; and logging sensitive data in error logs.