Dynamics 365 Business Central: Storing sensitive data for your extension? Use the Isolated Storage!

This is a quick post to signal a “worst practice” I’ve see today in a partner’s extension.

This extension needs to save some private data and the partner has decided to use the Service Password table for that scope. The Service Password table is a particular table (ID 1261, present also in NAV) with the following structure:

SensitiveData_01.png

This table was born in the NAV era for implementing the Service Data Encapsulation pattern. This table stores a key/value pair, where the key is a GUID and the Value is BLOB that contains the encrypted value of the key passed.

Why this is not a best practice in my opinion? Because now we’re in the extensions era, different extensions from different vendors could be installed in a tenant and for handling isolation of data there’s a dedicated system object for that: the Isolated Storage.

The Service Password table (or other similar tables) doesn not guarantee that your data is isolated in your extension scope. You can have an extension A that writes a sensitive encrypted data into this table and maybe an extension B that deletes that data. And if a malicious extension C modify that data or is able to decrypt that data?Where is your security?

In the extension world (and expecially with Dynamics 365 Business Central) for storing sensitive data with your extension you need to start using the Isolated Storage. This is a data storage that provides isolation between extensions, so that you can keep keys/values in one extension from being accessed from other extensions. The isolation is always per-extension and you can set also the scope visibility of the stored data (in order to restrict more the data visibility):

Member Description
Module Indicates that the record is available in the scope of the app(extension) context.
Company Indicates that the record is available in the scope of the company within the app context.
User Indicates that the record is available for a user within the app context.
CompanyAndUser Indicates that the record is available for a user and specific company within the app context.

The default value of DataScope is Module if not specified.

This is a small example of what you need to do for saving and retrieving a data from the Isolated Storage:

local procedure IsolatedStorageTest()

var

   keyValue: Text;

begin

   IsolatedStorage.Set('mykey','myvalue',DataScope::Company);

   if IsolatedStorage.Contains('mykey',DataScope::Company) then

   begin

      IsolatedStorage.Get('mykey',DataScope::Company,keyValue);

      Message('Key value retrieved is %1', keyValue);

   end;

   IsolatedStorage.Delete('mykey',DataScope::Company);

end;

This is extremely simple and (more important) secure! If extension A creates the key mykey in the Isolated Storage, no other extensions can access this data.

Please remember this and don’t use standard tables for storing sensitive data.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.