English

Application Security

At a minimum the following set of guidelines are requirements of application AppFoundry Partners listed on AppFoundry:

  1. All applications and integrations interfacing with Genesys Cloud must use TLS to encrypt all of its traffic and:

    • TLS version 1.2 (or higher) are required. TLS version 1.2 using AES 256 encryption or higher with SHA-256 MAC is recommended.
  2. For the domains where your app descriptor file is hosted and the domains specified (as the baseURL or other URLs) in the app descriptor file:

    • You must maintain control of these domains.
    • TLS certificates of these domains must be valid.
  3. The application must authenticate and authorize all requests.

  4. Data stored by your application and services must be authenticated and authorized.

  5. The application must not expose JWT Tokens and OAuth Tokens where they can be easily accessed including:

    • Referer headers
    • Public repositories, such as Bitbucket and Github
  6. The application must set HttpOnly and Secure when sending Set-Cookie headers for session-related cookies.