Make referrer domain restriction page specific

Hi Din,

We have reviewed your enhancement suggestion. Based on the information provided, our understanding of your request is:

* Provide mechanism so that ODS application can set restriction on specific pages

We acknowledge the benefit of your suggested enhancement however other enhancements are taking priority in our planning currently. Although we will not be addressing this item in the near term, your suggestion will be available for future consideration. This request will be closed, and we will not be taking any further action.


The following may contribute towards this requirement. The curam.referer.domains property allows for a list of valid referers to be specified from which the Curam application can be linked from. If you do not want to specify a list of individual domains, the property allows for a wildcard option to be used by using \\* Or the wildcard can be made more specific. For example, if \\*.com was to be used as the property value, only domains containing ".com" can link to the application (“.org” would be rejected).

Thank you for taking the time to share your ideas with us. Although we cannot pursue all the submitted suggestions, we are committed to involving our users in building our product roadmap and appreciate your ideas.

Thank you,

Angela Brady

Cúram Product Management Team

Hi Din,

We would like to inform you that we are still in the process of reviewing your request. We apologise for the delay however there are some complex issues we need to evaluate to ensure we conduct a thorough assessment.

Upon completion of our review, we will get back to you with a formal response or to request additional information.

Regards

Graham McCrindle, SPM Product Management Team

Hi Din,

Thank you for providing the additional information requested. Within the next 30 days we will review the details you have provided and inform you of our analysis and decision.

Regards,

SPM Product Management Team

Hi Graham,
I guess the solution provided is for Citizen Engagement application.

Just to clarify: MSD ODS is student loan public facing application which is Caseworker IEG and UIMs, which has few read only uim landing pages and SPM caseworker IEG . So our need is to access the read only uim landing pages without any restrictions and security restriction should apply on the subsequent IEG pages. As mentioned under the workaround that we have to customised the OOTB filter implementation for our EOS and CMS application which is an extra effort . If this features can be configurable made page specific then the customization could have been avoided.


There was an detailed discussion around this on the support Case number 0009165. The case has been concluded with suggestion to raise the enhancement request. Please refer for details.

Hi Din,

We have reviewed your enhancement suggestion and require more information to properly understand the issue and the business scenario you are trying to support.

Based on the information provided, our understanding of your request is:

• You require a mechanism to access the application front page without restrictions and that security restrictions should apply on subsequant pages.

We require some additional information/detail for our technical team to understand the issue further as It is unclear what the blocking issue is that prevents this from achieving this. WE have documented below a possible solution to your problem. Can you review and document why this approach would not work

The application you receive is a reference application and is fully customisable. In order to meet your needs it would appear that you need a "front page" that does not make any API calls to SPM to avoid triggering the CSRF protection. This can be achieved in many ways. One way would be by refactoring the App.js file to have a conditional view that does not make any API calls until the user moves to a different view by clicking something. The example below is simplified but the pattern could be applied to the App.js file in the reference application.

import React, { useState } from 'react';

const App = () => {
// State to track the active view
const [isNoAPIsView, setNoAPIsView] = useState(true);

// Function to toggle between views
const toggleView = () => {
setNoAPIsView((prevValue) => !prevValue);
};

return (
<div>
<h1>{isNoAPIsView ? 'Does not make API calls' : 'Makes API calls'}</h1>
<button onClick={toggleView}>Switch View</button>
</div>
);
};

export default App;

Please review and provide the requested information within 30 days so we may proceed with our evaluation. If we do not hear from you within that timeframe, we will have to close the request due to insufficient information.

Thank you,

Graham McCrindle, SPM Product Management Team

Hi Din,

Thank you for taking the time to share your ideas with us. We are committed to involving our users in building our product roadmap and appreciate your suggestions.

We will review the information you have provided and get back to you within 30 days. If additional details are required to complete our evaluation, we will send you a request for more information.

Thank you,

Graham McCrindle, Curam Product Management Team