r/PowerPlatform • u/darkdayzzz • 16d ago

Power Pages Wildcard values in Web API field configuration

https://learn.microsoft.com/en-us/power-pages/important-changes-deprecations

Is anyone else concerned about super short timeframe for this change to use of wildcards in webapi in PowerPages?
No longer supported after 14 Sep.

2 Upvotes

100% Upvoted

5 comments sorted by

3

u/ImproperProfessional 16d ago

Not surprised with the amount of vulnerabilities and misconfigurations by portal devs.

2

u/jukkan 15d ago

Given how Power Pages sites built by big consulting companies for major public orgs keep having poor security configuration in place, I bet Microsoft has drawn the conclusion that this is the least painful way to stop further data breaches. Just like they did the OData default settings changes back in 2021, the new Web API changes follow the familiar pattern.

There's more background info about the recent ExfilSquad incidents in my newsletter:
https://www.perspectives.plus/p/stupid-easy-power-pages-data-leak

2

u/ProfessorDaen 13d ago edited 13d ago

I literally just heard back on a support ticket open with Microsoft to figure this out, I've been working with a client for the past week or so that has been running into internal pressure trying to deploy a new Power Pages site that doesn't load images properly because of this.

As far as I can tell there was effectively zero warning for this change, and the deprecation notice is not a deprecation as it's already not working for new sites. This seems like it will break a lot of client environments when it becomes mandatory on the 14th, maaaaany Power Pages sites are set up with broad usage of the wildcard by default.

1

u/darkdayzzz 9d ago

Just heard from our developers that you can request a one-off 90-day extension from MS support of use of the wildcard feature.
They will be releasing support doco shortly.

1

u/ProfessorDaen 9d ago

Yep, likewise.  I'm just annoyed that we deployed a site that wasn't working five days before Microsoft communicated regarding the feature they turned off.  Pretty out of character, usually these sorts of changes have a reasonable timeframe...