Configuring web applications

Key differences when using a default application template versus an application installed from Nexthink Library:

• After importing and implementing the selected configuration template, you cannot edit or drop these default settings.

• Modifications from Nexthink to built-in default configurations impact all applications using these imported settings—even after saving the web application configuration.

Nexthink Applications uses the following set of rules to verify the pattern before saving it:

1. The user must enter at least one URL match pattern.

2. Today, specifying a scheme like http://</code> or <code>https:// is not supported, it must be *://

3. If the user does not specify *:// the form automatically adds the *:// prefix.

4. If the user enters a URL with a port number, the form displays an error message.

5. The host component can start with *. followed by part of the fully qualified domain name (FQDN). Note that this pattern also matches a hostname that is exactly the expression entered after the *. wildcard.

6. The host component must end with a complete and valid domain name if it starts with a *. wildcard.

7. The host component can just contain a local hostname (for example, no domain name) if it does not start with a *. wildcard. This is to support internal web applications that do not use FQDN.

8. You must specify the path with at least /*. If the user does not enter a path, the form logic appends /* to match all paths.

9. The path must end with a * wildcard. If the path does not, the form logic appends * to the pattern.

10. The path cannot contain more than one * wildcard.

11. The pattern must not contain a query string (?...). If the user enters a URL with a query string, an error message appears.

12. The pattern must not contain a fragment (#...). If the user enters a URL with a fragment, an error message appears.

13. Validation logic prevents patterns that intersect each other across all the applications.

14. The entire match pattern must validate as a standard URL after adding an http:// prefix and replacing all wildcards with arbitrary words. For example, if the user enters the pattern *.example.com/foo/* the expanded form http://www.example.com/foo/bar can be easily validated using a standard URL validation library.

15. Entering only a domain name for a host part like example.com is valid. It will not match, however, the URL name with a hostname like www.example.com.

16. The form logic auto-corrects the pattern entered by the user, it does this immediately after the textbox loses focus, and the user interface allows the user to see the change before the form is submitted.

17. A pattern intersects another pattern if at least one URL that is matched by both patterns exists. Explicitly, patterns  A1  and  B1  intersect if all of the following conditions are true:

    • After trimming the eventual wildcard from the beginning of the host parts, A1.host ends with B1.host or B1.host ends with A1.host.

    • After trimming the wildcard from the end of the path, A1.path starts with B1.path or B1.path starts with A1.path.

The URL pattern examples below are valid for web applications:

• www.example.com/* matches all URLs that start with http://www.example.com/ or https://www.example.com/.

• *.example.com/* matches example.com, www.example.com, intra.example.com, support.intra.example.com, …

• *.intra.example.com/* matches intra.example.com, support.intra.example.com, ...

• example.com/* matches only *://example.com/*.

• www.example.com/foo/* matches all URLs that start with *://www.example.com/foo/.

• myintranet/* is a valid pattern for an internal application.

• www.example.com/foo/* is an existing app match pattern. In this case, the following patterns can be used for any of the applications:

  • *.example.com/bar/*

  • www.example.com/foobar/*

  • *.another-example.com/foo/*

  • test.example.com/foo/*

The URL pattern examples below are invalid for web applications:

• www.example.*/*

• https://*.example.com/*  because of the scheme

• www.*.com/*

• www.*.example.com/*

• www.example.com/foo?bar because query string components are not supported

• */*

• www.example.com/foo#bar because hash components are not supported in the application URL

• *.example:1234.com/* because of the port (use *.example.com/* instead, all ports are supported)

• *.example.com/#foo

• *example.com/* because there is no dot following the star in the host component

• www.example.com/foo/*/bar/* only one wildcard is allowed in the path

• *.customer.*.example.com/* only one wildcard is allowed in the host part

• www.example.com/foo* is an existing app match pattern. In this case, you cannot use the following intersecting patterns for any of the applications:

  • *.example.com/foo/*

  • www.example.com/foobar/*

  • www.example.com/fo*

  • www.example.com/foo/bar/*

• www.example.com changes to *://www.example.com/*

• www.example.com/ changes to *://www.example.com/*

• www.example.com/foo/ changes to *://www.example.com/foo/*

• www.example.com/foo changes to *://www.example.com/foo/*

• example.com changes to *://example.com/*

• *.example.com changes to *://*.example.com/*

Access the corporate document management system using the following URL:

https://prod.doxydoc.local:32890/start.php

During the business application configuration, you must use the following pattern:

*://prod.doxydoc.local/start.php*

Whenever possible, Nexthink sanitizes all collected Uniform Resource Locators (URLs) to conceal sensitive information. This is done in an attempt to remove personal data, potential configuration secrets and certain query string patterns.

Remember, a URL is a string that serves as a unique identifier for a web resource, consisting of four primary components:

• The origin includes the protocol ( http or https), the hostname ( http://nexthink.com ) and the port number (80 or 443), for example, https://nexthink.com:443.

• The pathname specifies the exact location of the resource on the server, for example /company/about-us.

• The hash is an optional component of the URL that stores information for the browser, such as the current state of the web page or user preferences. It also begins with a hash (#) and is followed by a string, for example, in the URL confluence.nexthink.com/pages/urlsanitisaation#url-sanitisation-rules, the hash segment is #url-sanitisation-rules.

• The query parameters are optional pairs of keys and values that provide additional information to the server. They start with a question mark (?) and are separated by ampersands (&), for example, ?projectKey=DCBSM&view=detail. The query parameters are systematically sanitized. The system replaces each key-value pair with [key], for example:

  • https://confluence.intra.nexthink.com/pages/viewrecentblogposts.action?key=AppExEP sanitized with [key]: https://confluence.intra.nexthink.com/pages/viewrecentblogposts.action?[key]

URL sanitization mechanism

The URL sanitization mechanism is intended to strip sensitive information from URLs before transmitting them to the server by:

1. Initially removing all query parameters, such as ?key1=value1&key2=value2, retaining only the keys enclosed in square brackets, like ?[key1]&[key2].

2. Replacing any other anchors in the hash segment with the code [anchor].

3. Undergoing further URL sanitization based on specific patterns as described below.

4. Finally, truncating any excessive parts of the URL.

Remember that this process ensures that sensitive data is not inadvertently exposed in URLs.

Pattern matches and tag replacements

Examples of general codes the system uses to sanitize an application’s URL:

These patterns are specified globally for all applications. If any part of the Sanitized URL matches any of the patterns, it will be replaced by the corresponding tag.

Examples:

• https://community.nexthink.com/s/profile/0052p00000BURowAAH sanitized with [hex]: https://community.nexthink.com/s/profile/[hex]

• https://outlook.office.com/mail/inbox/id/AAQkAGJhYmFkMTUxLTQ5NzgtNDNlZi1iZDkzLTQ2YzEwNDIwYzA0YgAQAKafeoP2TMVDozSlcBq2JGU%3D sanitized with [gib]: https://outlook.office.com/mail/inbox/id/[gib]

The following table summarizes the Nexthink process for sanitizing URLs: