News and Announcements icon

Power Platform CommunityForums Power Apps - Connector Development SQL Injection: Prevent...

Power Apps - Connector Development

Unanswered

SQL Injection: Preventing Sensitive Data Exposure in PowerApps - Masking Headers: x-ms-request-url

(0) Share

Report

Report

Posted on by darkhorse12

26

I’m working on securing PowerApps connections to SQL databases but noticed sensitive information like x-ms-request-url could potentially be exposed, raising concerns about SQL injection risks. While PowerApps is known for its security, I believe there must be a way to prevent these headers from being exposed. Has anyone used Azure API Management (APIM) or Content Security Policy (CSP) for masking headers or preventing potential vulnerabilities? Any suggestions or best practices would be greatly appreciated!

Categories:

Policy Templates

sqlInjection.png

All responses Img

All responses (1)

Answers Img

Answers (0)

Suggested answer

SaiRT14 1,988 Super User 2025 Season 1 on at

Like (0)

Report

SQL Injection: Preventing Sensitive Data Exposure in PowerApps - Masking Headers: x-ms-request-url

Here are the best practices:

APIM acts as a gateway between your PowerApps and SQL databases, enabling you to control, mask, or block sensitive headers.

Ensure that SQL queries in PowerApps, especially in custom connectors or flows, use parameterized queries:

Instead of storing connection credentials, use Azure Managed Identity to authenticate PowerApps with SQL databases.

Ensure SQL endpoints are only accessible from trusted IP ranges or services like APIM.

Helpful resources

News and Announcements

Welcome to the Power Platform Communities

Quick Links

Leaderboard > Power Apps

#1

WarrenBelz 791 Most Valuable Professional

#2

MS.Ragavendar 410

#3

mmbr1606 275 Super User 2025 Season 1

Last month Overall leaderboard

Featured topics

Product updates

Microsoft Power Platform Community release plans