---
id: change/bcapps/11171
type: change
title: "#11171 [Security][Hardening] Validate integration URLs stored in setup tables"
summary: Integration endpoint URLs stored in setup tables are now validated against their expected host and scheme before use to prevent credential redirection to malicious endpoints. The validation applies to Pagero, SignUp, Logiq, Shopify, Document Exchange, and Dataverse connectors, falling back to hardcoded values on mismatch.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit shpfy authentication mgt.
  - codeunit cds integration impl.
  - codeunit crm integration management
  - codeunit commercial dataverse endpoints
  - interface dataverse cloud endpoints
  - codeunit doc. exch. service mgt.
system: integration
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:04:09.054Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: a28dcf675c37aa80b2b984fe6203455c1aa6a430
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11171
    title: "microsoft/BCApps#11171: [Security][Hardening] Validate integration URLs stored in setup tables"
    date: "2026-09-22"
    commit: a28dcf675c37aa80b2b984fe6203455c1aa6a430
    t: null
    quote: Validate integration endpoint URLs stored in editable setup tables against their hardcoded expected host and scheme before use
links:
  learn: []
  objects:
    - object/codeunit/30199
    - object/codeunit/7201
    - object/codeunit/5330
    - object/codeunit/7208
    - object/interface/dataverse-cloud-endpoints
    - object/codeunit/1410
    - object/codeunit/3060
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11171
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11171
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-22T18:43:55Z"
author: onbuyuka
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "AL: System Application"
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 21
  additions: 573
  deletions: 33
  al: 7
apps:
  - Base Application
  - Shopify
  - System Application
objects_touched:
  - key: codeunit/30199
    page: codeunit/30199
    type: codeunit
    id: 30199
    name: Shpfy Authentication Mgt.
    app: Shopify
    status: modified
  - key: codeunit/7201
    page: codeunit/7201
    type: codeunit
    id: 7201
    name: CDS Integration Impl.
    app: Base Application
    status: modified
  - key: codeunit/5330
    page: codeunit/5330
    type: codeunit
    id: 5330
    name: CRM Integration Management
    app: Base Application
    status: modified
  - key: codeunit/7208
    page: codeunit/7208
    type: codeunit
    id: 7208
    name: Commercial Dataverse Endpoints
    app: Base Application
    status: modified
  - key: interface/dataverse cloud endpoints
    page: interface/dataverse-cloud-endpoints
    type: interface
    id: null
    name: Dataverse Cloud Endpoints
    app: Base Application
    status: modified
  - key: codeunit/1410
    page: codeunit/1410
    type: codeunit
    id: 1410
    name: Doc. Exch. Service Mgt.
    app: Base Application
    status: modified
  - key: codeunit/3060
    page: codeunit/3060
    type: codeunit
    id: 3060
    name: Uri
    app: System Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 614071
systems:
  - integration
  - platform
quote: Validate integration endpoint URLs stored in editable setup tables against their hardcoded expected host and scheme before use
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #11171 [Security][Hardening] Validate integration URLs stored in setup tables

> Integration endpoint URLs stored in setup tables are now validated against their expected host and scheme before use to prevent credential redirection to malicious endpoints. The validation applies to Pagero, SignUp, Logiq, Shopify, Document Exchange, and Dataverse connectors, falling back to hardcoded values on mismatch.

[Pull request](https://github.com/microsoft/BCApps/pull/11171) · merged into `main` (BC30) on 2026-09-22 by onbuyuka · 21 files (+573 -33), 7 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- URLs must match both host and scheme; https-to-http downgrades are rejected
- Malformed stored URLs fall back to hardcoded endpoints instead of throwing errors
- Online (SaaS) Document Exchange connections are pinned to Tradeshift; on-premises uses stored URLs unchanged
- Dataverse environments must match the configured cloud's trusted host suffix
- Shopify validates shop hostname before OAuth authorize and token endpoints
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 30199 "Shpfy Authentication Mgt."](../../objects/codeunit/30199.md), Shopify: modified
- [Codeunit 7201 "CDS Integration Impl."](../../objects/codeunit/7201.md), Base Application: modified
- [Codeunit 5330 "CRM Integration Management"](../../objects/codeunit/5330.md), Base Application: modified
- [Codeunit 7208 "Commercial Dataverse Endpoints"](../../objects/codeunit/7208.md), Base Application: modified
- [Interface "Dataverse Cloud Endpoints"](../../objects/interface/dataverse-cloud-endpoints.md), Base Application: modified
- [Codeunit 1410 "Doc. Exch. Service Mgt."](../../objects/codeunit/1410.md), Base Application: modified
- [Codeunit 3060 "Uri"](../../objects/codeunit/3060.md), System Application: modified

## Context

- Work items: AB#614071
- Labels: AL: Apps (W1), AL: System Application, Team: Integrations
- Systems: integration, platform
- From the description: "Validate integration endpoint URLs stored in editable setup tables against their hardcoded expected host and scheme before use"

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).