{"id":1312,"date":"2020-02-25T12:22:31","date_gmt":"2020-02-25T12:22:31","guid":{"rendered":"https:\/\/sdf-docs.mansystems.com\/docs\/acr-rules\/security\/exposedconstant\/"},"modified":"2021-07-30T09:09:53","modified_gmt":"2021-07-30T09:09:53","slug":"exposedconstant","status":"publish","type":"docs","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/exposedconstant","title":{"rendered":"Constants should not be exposed to the client"},"content":{"rendered":"\n<p>Constants should not be exposed to the client if they contain sensitive information.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p> When a constant is exposed to the client, Mendix Runtime sends its value to the client so that in addition to microflow expressions, it will also be accessible from nanoflows and page expressions. This means that you should not use sensitive data or secrets such as passwords when a constant is exposed to the client. <\/p><cite>Mendix docs <a href=\"https:\/\/docs.mendix.com\/refguide\/constants#4-2-exposed-to-client\">https:\/\/docs.mendix.com\/refguide\/constants#4-2-exposed-to-client<\/a> <\/cite><\/blockquote>\n\n\n\n<p>To determine if a constant is sensitive ACR checks if the constant name contains a sensitive keyword such as <em>password <\/em>or <em>key<\/em>. The list of sensitive keywords is configurable e.g. &#8220;<em>password,key<\/em>&#8220;. Not case sensitive. Leave it empty to violate for every constant that is exposed to the client (default).<\/p>\n\n\n\n<p><strong>Non-compliant example:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"775\" height=\"457\" src=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-27.png\" alt=\"\" class=\"wp-image-1315\" srcset=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-27.png 775w, https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-27-480x283.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 775px, 100vw\" \/><\/figure>\n\n\n\n<p><strong>Compliant example:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"780\" height=\"410\" src=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-28.png\" alt=\"\" class=\"wp-image-1316\" srcset=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-28.png 780w, https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2020\/02\/image-28-480x252.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 780px, 100vw\" \/><\/figure>\n","protected":false},"featured_media":0,"parent":96,"menu_order":4,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-1312","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/1312"}],"collection":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1312"}],"version-history":[{"count":3,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/1312\/revisions"}],"predecessor-version":[{"id":1319,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/1312\/revisions\/1319"}],"up":[{"embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/96"}],"next":[{"title":"Demo users should be turned off","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/nodemousers","href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/506"}],"prev":[{"title":"A strong password policy should be set","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/strongpasswords","href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/498"}],"wp:attachment":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1312"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdoc_tag&post=1312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}