I don't know the *exact* details of the authentication, but it's going to result in the client getting a token. The security is HTTPS. If anything can intercept that token, they are doing a man-in-the-middle attack, or have enough of your credentials to generate a token, or can decrypt your HTTPS traffic in some other way (such as Fiddler or Wireshark). We use this mechanism when we do load testing, UI testing, and so on. So on the one hand, yes, this sounds slightly alarming, that someone can get a token either by generating one or by capturing one. But on the other hand, once someone has the ability to do that, you are breached already.

With the token, all they can do is access the underlying REST endpoints (all of the Data Actions and Aggregates at the screen level will generate a REST endpoint) and the screen itself. it isn't like they can take the token and start running queries directly on the data; they can only do what you programmed the app to be able to do. (This is a big reason why Reactive security is a really important topic, to protect yourself in case of something like this.)

J.Ja

Hello Daniel,

Is this the documentation you are looking for?

https://success.outsystems.com/Documentation/11/Managing_the_Applications_Lifecycle/Secure_the_Applications/Configure_App_Authentication#Authentication_Cookies

Regards,

Daniel