Best Practices for Secure Handling of User Information in the Forms Module

To enhance security and protect user information, especially in the Forms module, adhere to the following best practices:

• Limit Exposure of Sensitive Information: Avoid displaying usernames directly in the Owner column, as they are part of the user's credentials and could be exploited by malicious users. Instead, configure the system to display the user’s display name or another non-sensitive identifier.

• Use Display Names in Workflows and Forms: Configure the Owner field to show display names rather than repository usernames when users log in through providers like Microsoft Entra ID, Active Directory, Active Directory with token authentication, and Forms. This setup minimizes exposure of sensitive credentials.

• Understand Provider-Specific Behavior: Note that for certain providers, such as Repository User Provider and ASP.NET, the Owner field will display the actual username, as the display name and repository username are the same. Ensure this setup aligns with your security requirements.

By following these practices, you can mitigate the risk of exposing sensitive user information and maintain a secure environment for users.