#12194 Harden web request helpers: opt-in default credentials
Http Web Request Mgt. and SOAP Web Service Request Mgt. now disable default credentials by default and require callers to opt in with SetUseDefaultCredentials(true) for on-premises installations, preventing unintended transmission of Business Central service account credentials to external hosts.
- 6files
- 3AL files
- 3objects
Pull request · merged into main (BC30) on 2026-10-02 by darjoo · 6 files (+51 -5), 3 AL · breaking · tier official · reviewed (checked by Opus)
What changed
- Http Web Request Mgt. and SOAP Web Service Request Mgt. no longer use default credentials unless the caller opts in
- New OnPrem SetUseDefaultCredentials(Boolean) lets callers turn default credentials back on
- Fault-response trace logging in Http Web Request Mgt. is now off by default; use SetTraceLogEnabled(true)
- Extension Marketplace never sends default credentials for its AppSource telemetry callback
- Library - Graph Mgt test library opts in because API tests call the local BC server
- Breaking: existing extensions can stop compiling or working.
AL objects touched
- Codeunit 1297 “Http Web Request Mgt.”, Base Application: modified
- Codeunit 1290 “SOAP Web Service Request Mgt.”, Base Application: modified
- Codeunit 2501 “Extension Marketplace”, System Application: modified
Context
- Work items: AB#652511
- Labels: AL: System Application, Team: Integrations
- Systems: integration, development
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).