Question on globalConfig client side object (was available in CS 16.0.5 but is gone is CS 16.2.3)

Harry_L

Can anyone give some pointers on Mihails' question OTCS ticket 3390114 :

In CS 16.0.5 we have used globalConfig object (thas is available anywhere in smartUI on client side) to recieve otcs ticket. Construction we used was (on javascript level):

globalConfig.config["csui/utils/contexts/factories/connector"].connection.session.ticket

Now, in CS 16.2.3 this object is not available. What alternative object / property we should use to recieve otcs ticket?
In our solution we use globalConfig.config["csui/utils/contexts/factories/connector"].connection.session.ticket to get ticket of the current session and using it in REST requests. When i can`t recieve this ticket our REST requests are not working as soon as ticket should be one of the parameters. If you can point me from what smartUI client side structure i could take this ticket it would be great. 

We are not using Smart UI SDK.

Our goal is to recieve this value: globalConfig.config["csui/utils/contexts/factories/connector"].connection.session.ticket. If there are alternatives way to do it on client side - please point me.

Could this work: window.csui.require.s.contexts._.config.config["csui/utils/contexts/factories/connector"].connection.session.ticket ?

Ferdinand Prantl

I don't know, who created the globalConfig object. It was probably some Smart UI extension, which didn't follow the rule - no pollution of the global space. As you found out, if you don't depend on a public interface, your code may be broken by any CS update.

You are not supposed to access objects in the global space leaked by incorrectly implemented Smart UI components. (csui.require is the only exposed function and it provides the RequireJS API.) Accessing private configuratiuon of RequireJS modules, like csui.require.s.contexts._.config.config["csui/utils/contexts/factories/connector"], is yet another exploit of a private implementation, both RequiureJS and csui/utils/connector, which is not meant to be guaranteed as a public interface. Once somebody opens a XSS bug against csui about this, you will lose it again. (Well, if somebody can access the window object freely, the fortress has been breached already, but it should be still worth not to let the attacker to the tower for free...)

Authentication ticket obtained by Smart UI authenticators can be requested only from within a Smart UI extension. There is no interface available for foreign components. They should obtain the ticket from the same originator, which provided the ticket to Smart UI components.

Why are you looking for the authentication ticket like this? Why don't you use one of public interfaces, how to do it - OScript or REST API?