#11171 [Security][Hardening] Validate integration URLs stored in setup tables

Pull request · merged into main (BC30) on 2026-09-22 by onbuyuka · 21 files (+573 -33), 7 AL · fix · tier official · reviewed (checked by Opus)

What changed

• URLs must match both host and scheme; https-to-http downgrades are rejected
• Malformed stored URLs fall back to hardcoded endpoints instead of throwing errors
• Online (SaaS) Document Exchange connections are pinned to Tradeshift; on-premises uses stored URLs unchanged
• Dataverse environments must match the configured cloud’s trusted host suffix
• Shopify validates shop hostname before OAuth authorize and token endpoints
• Behaviour changes for users or extensions.

AL objects touched

• Codeunit 30199 “Shpfy Authentication Mgt.”, Shopify: modified
• Codeunit 7201 “CDS Integration Impl.”, Base Application: modified
• Codeunit 5330 “CRM Integration Management”, Base Application: modified
• Codeunit 7208 “Commercial Dataverse Endpoints”, Base Application: modified
• Interface “Dataverse Cloud Endpoints”, Base Application: modified
• Codeunit 1410 “Doc. Exch. Service Mgt.”, Base Application: modified
• Codeunit 3060 “Uri”, System Application: modified

Context

• Work items: AB#614071
• Labels: AL: Apps (W1), AL: System Application, Team: Integrations
• Systems: integration, platform
• From the description: “Validate integration endpoint URLs stored in editable setup tables against their hardcoded expected host and scheme before use”

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).