Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-05 22:56:55 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bcquality/microsoft/knowledge/security/nondebuggable-required-when-unwrapping-secrettext.md
Jesper Schulz-Wedde b6da405376 Improve partner onboarding and documentation navigation 
Lead with a complete plugin quick start and add task-oriented usage, troubleshooting, customization, and contribution guides. Preserve the broader plugin framing, correct conflicting contract guidance, support Agents folder reviews, and align repository validation. Convert existing sample references to clickable links without changing knowledge rules.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-09 17:25:29 +02:00

1.4 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
23..
security
nondebuggable
attribute
secrettext
unwrap
debugger
al
w1
all

On-premises only: protect unavoidable SecretText.Unwrap calls

Description

SecretText.Unwrap() is supported only for Business Central on-premises and exists for compatibility. It converts a protected value to plain Text, where debugger redaction no longer applies. [NonDebuggable] prevents the debugger from inspecting a procedure's parameters and locals, but it does not make the resulting Text safe to return, log, or pass through debuggable code.

Best Practice

In SaaS, keep the value as SecretText and use secret-aware APIs instead of unwrapping. For an unavoidable on-premises legacy API that accepts only Text, keep the plain-text path as short as possible and mark every procedure in that path [NonDebuggable]. Do not return the unwrapped value. See sample: nondebuggable-required-when-unwrapping-secrettext.good.al.

Anti Pattern

Calling Unwrap() in cloud-targeted code, or calling it in an on-premises procedure that is debuggable or returns the resulting Text. Both defeat the protection that SecretText provides. See sample: nondebuggable-required-when-unwrapping-secrettext.bad.al.