Mandatory Sandboxing for the Okta Workflows Return Raw Flow Control Card
Last Updated:
Starting February 2, 2027, Okta Workflows automatically sandboxes any HTML or XML content returned by the Return Raw Flow Control card to protect against Cross-Site Scripting (XSS). Flows returning simple JSON or plain text data are unaffected, but flows that rely on cookie access or scripted XML and SVG content require review and remediation before that date.
What Is Sandboxing?
Sandboxing places returned content inside a secure, isolated container rendered as an iframe. Even if the content contains a script, that script cannot access the Okta session, cookies, or any other part of the Workflows platform.
How the Change Affects Return Raw Flow Behavior
Flows returning JSON or plain text see no change. Flows that return HTML, untyped content, or XML-based formats are affected according to the following behavior matrix. Review each content type and take the corresponding action:
|
Content-Type |
New Behavior |
Action |
|---|---|---|
|
text/html |
Sandboxed (scripts isolated) |
If the flow logic relies on access to the document, remove that logic. |
|
None Specified |
Sandboxed (defaults to HTML) |
Same as above. |
|
XML / SVG / XHTML |
Blocked |
Transition away from using the type. |
|
application/json |
No change (safe) |
No action required. |
Recommended Steps for Auditing and Refactoring Affected Flows
Identify all affected flows, validate behavior in the Preview environment, and transition HTML-returning flows to JSON before the February 2, 2027 implementation date by following these steps:
-
Audit: Identify flows that use the Return Raw card with HTML content.
-
Test: Validate those flows in the Preview environment, where this change is already active.
-
Refactor: Transition flows to return JSON data instead of raw HTML wherever possible.
