Configuring a CSP-Based Web Application

Specifies the identifier for the application. The name must include a leading slash (/), such as in the /myorg/myapp application.

For information on reserved names, see Create and Edit Applications.

Specifies a text description of the application.

Specifies the namespace where this application runs. When you select a different namespace, the dialog immediately displays the default application for that namespace to the right of this drop-down menu.

Specifies whether the application is the default application for this namespace. The %System.CSP.GetDefaultApp() method returns the default application for the namespace. InterSystems IRIS® data platform import functions, such as $system.OBJ.Load() or $system.OBJ.ImportDir(), use the default application when importing a page without an associated application.

Specifies whether the application is available for use. When enabled, an application is available, subject to user authentication and authorization; when disabled, it is not available.

Select CSP/ZEN.

Specifies whether to enable use of Business Intelligence and Natural Language Processing within this application.

Specifies whether to serve SOAP requests from within this application. Uncheck to disable.

Specifies whether the application automatically prevents Cross-Site Request Forgery (CSRF) attacks. InterSystems recommends that you enable this option for all new applications; it is also recommended for all existing applications except if there is code that programmatically requests pages from the application.

A resource for which users must have the Use permission so they can run the application.

Note that you can also specify required resources within CSP page classes. Both mechanisms are applied.

For use by By-ID groups to enable you to share authentication across multiple web applications. Enter a group name for this application to share authentication privileges with all other applications with this group name.

The application’s supported authentication mechanisms, from the set of defined mechanisms.

Specify classes whose methods can be executed within this application. There are three ways to do this:

• Use an ObjectScript match pattern. Example: 1"myclass".3N allows myclass123.cls to run in this application, but not myclassxy.cls

• Use an ObjectScript expression that evaluates to a boolean, prefixed with @. The requested class name is passed as a variable named class. Example: @class = "PermittedClasses.PermittedPage"

• Use a call to a class method (can also use @syntax). Example: ##class(MyPackage).CheckClassIsPermitted(class)

See also Enabling Application Access to %CSP Pages.

The default session timeout in seconds. You can override this value programmatically.

Note that a user moves from one web application to another during a session, the timeout period is still controlled by the first web application used during the session. For example, if a session starts out in Web Application A, with a default timeout of 900 seconds, and then moves into Web Application B, which has a default timeout of 1800 seconds, the session still times out after 900 seconds. In such a case, you may want to define a session event class to update the session timeout.

The default name of the class that handles web application events, such as a timeout or session termination.

Whether or not the application tracks the browser session by using a cookie. Choices are:

• Always — Default. Always use a cookie to track the browser session.

• Never — Never use a cookie to track the browser session.

• Autodetect — Use a cookie to track the browser session unless the client browser has disabled them. If the user has disabled cookies, the application uses URL rewriting to track the browser session.

Note that this option does not set whether the application uses cookies; rather, it controls how the application manages sessions, subject to the user’s preferences. Further, even with values of Always or Autodetect, an application uses cookies only if it contains specific code to do so.

The portion of the URL that the browser uses to send the session cookie back to InterSystems IRIS for this application. If you do not specify a value for this field, the application uses the value of the Name field with leading and following slashes as its default scope. Hence, for an application named myapp, specifying no value here means that /myapp/ is the scope.

The application only sends the cookie for pages within the specified scope. If you restrict the scope to pages required by a single web application, this prevents other web applications on this machine from using this session cookie; it also prevents any other web application on this web server from seeing the cookie.

Note that a primary application and its subapplications can have different security settings while simultaneously sharing a session cookie (if they all use the primary application’s path).

Controls the default value of the SameSite attribute for session cookies.

Controls the default value of the SameSite attribute for application-specific cookies.

Controls whether to serve static files from the directory specified by Physical Path.

• No — Never serve files from this application path.

• Always — Default. Always serve files from this application path and ignore the CSP security setting for this path for static files. This is the default for new applications; it is backward compatible with applications that previously had static files served from the web server.

• Always and cached — Always serve files from this application path and allow the Web Gateway to cache these files to avoid having to request them from InterSystems IRIS. This is the mode that deployed applications are expected to use.

• Use CSP Security — If you have permission to view a CSP page in this application, then you can also view static files. If you do not have permission to view a page, then you see a 404 page not found message.

Specifies the length of time for which the browser should cache static files (in seconds). Default is 3600.

The directory on the InterSystems IRIS server from which to serve files for this web application. The path is relative to the install-dir/csp/ directory.

Optionally specifies the name of a CSP page class, which may be prefixed with the full web application path. For example: /csp/user/MyApp.LoginPage.cls

Usually, the login page is loaded before the user has logged in to InterSystems IRIS, so the requesting process runs under the CSPSystem user (or whatever user connects the CSP Gateway to InterSystems IRIS). As a result, the CSPSystem user must have sufficient privileges to load and run the code in the login page, which generally requires READ permissions on the resource protecting the database in which the login page is located.

Optionally specifies the name of the page class to use when changing password.

Optionally specifies the name of a CSP error page class to display if an error occurs when generating a page within this application.