SA-18040

Summary

DWA (Direct Web Access) functionality works fine except for attachments.
The requirement is to attach a file, from external flow action, in response.  However, when the button is clicked, an error message displays. Furthermore, when the hyper link of DWA is clicked, sporadically, the browser displays the same error message in the entire browser.

Error Messages

This request for information cannot be processed (Session state is invalid)

Steps to Reproduce

1. In DWA, try to attach a file from external flow action.
2. Use "AttachContent" control.
3. When you click on the button, you see a pop-up with an error message.

Root Cause

For security reasons, the external assignment using DWA must be static - not generated or altered by JavaScript or other processing at runtime. Due to this restriction, the flow action cannot use AJAX, dynamic select, SmartPrompt, which require multiple server interactions. 

Resolution

Here’s the explanation for the reported behavior: 

DWA Significance and Investigation notes
 

1. DWA can be configured for obtaining some inputs from external parties through email. Most likely for data entry using Text fields, Radio Buttons, Checkbox, dropdowns and so on.
2. When the recipient clicks this link, a browser session opens and submits a one-time-only signature token to the Process Commander server. Process Commander evaluates the token to authenticate the external user and displays the assignment in browser window. The user completes and submits the requested information, which ends the requestor connection. The link can be used only once.
3. For security reasons, the external assignment using DWA must be static and not generated or altered by JavaScript or other processing at runtime. Due to this restriction, the flow action cannot use AJAX, dynamic select, SmartPrompt, which require multiple server interactions.
4. In this use case, clicking AttachContent on an external assignment fires one AJAX call to retrieve Attach Files div content and this is restricted in DWA, an error message “Access Denied, can't be processed error” displays.

The same specification can be found in the below link – (How it Works) section.

https://pdn.pega.com/sites/default/files/help_v719/procomhelpmain.htm#howto/howto2/howtodirectedwebaccess.htm