What is changing?
The service will restrict access to additional property names within the event.request.query and event.request.body objects when executing actions for the post-login and credentials-exchange triggers. Tenants identified as using actions that may reference request properties planned for restriction will maintain access until September 16, 2025.
The service will restrict the following property names in the request-related objects:
auth_sessionauthn_responseclient_secretclient_assertionrefresh_token
Previously, the implementation of an action could access the properties listed above in event.request.query and event.request.body to retrieve the value included in the corresponding network request. Once the planned restrictions become effective for a given tenant, all properties above will be undefined independently of the network request content.
The rollout of these additional restrictions is in progress for tenants where historical data did not show any actions using these property names. Tenants identified as potentially impacted by these restrictions will maintain existing behavior until the previously mentioned date.
Why are we making this change?
By restricting access to these properties, we aim to prevent potential mishandling of sensitive data within the custom code implemented for post-login and credentials-exchange actions. For example, we reduce the risk of unintentionally logging sensitive data in log operations that may output the whole request object.
How are you affected?
If any of your tenant's current actions no longer include any reference to one of the restricted property names or that despite having references to one of the names, it is not in the context of property access to event.request.query and event.request.body objects, then these changes should not impact your tenant.
If there are actual references to restricted request properties, the restriction of these properties may impact the action's logic. After the changes become effective, accessing those request properties will always return undefined. Without revising the actions' implementation, the respective authentication flows risk partial degradation or complete failure.
What action do you need to take?
If your tenants currently have actions referencing one of the restricted properties of the event.request.query and event.request.body objects in their implementation. For applicable actions, you must update their implementation to stop relying on the restricted properties of the request objects.
The exact implementation changes you may need to perform will depend on your overall implementation of the actions and each restricted request property's usage scenario.
For example, for scenarios related to reusing secret information previously available from the request, the support for secret management (event.secrets) as part of actions may provide a potential alternative. If the requests include restricted property names, but the information sent within them is not considered sensitive, you may consider using a different parameter name in the request, or ideally, consider using custom parameters as part of pushed authorization requests to avoid disclosing/interception of the data by end-users in browser-based flows. If the data is static per client or connection, consider storing it as part of client or connection metadata.
