Deluge security enhancements

Deluge security enhancements

Hello everyone,
At Deluge, security is a top priority, and we're continuously working to enhance the platform's safety and reliability. As part of our ongoing commitment to secure coding and industry best practices, we're rolling out key updates to how authentication is handled in Deluge. Here's what's changing:
  • Deprecation of embedded credentials in invokeURL
  • Automatic revocation of inactive connections

Deprecation of embedded credentials in invokeURL

The invokeURL task currently allows users to directly embed their username and password in the URL field (for eg: url: "http://username:password@example.com/resource"). 

We are deprecating support for this capability. Going forward, we strongly recommend using connections to securely handle authentication, while the URL field in the invokeURL task should be used strictly for endpoint URLs.

Why is this changing? 
Embedding credentials directly within URLs introduces serious risks, such as your information being:
  • Logged inadvertently in browser histories, proxy servers, or even your own server logs
  • Exposed through phishing attacks
  • Blocked by popular browsers and API tools, leading to unreliable integrations
What you need to do
We urge you to review your existing invokeURL implementations and update any instances where credentials are directly embedded in the URL. Failure to do so after the rollout of this update will result in execution errors.

We recommend that you use connections to continue integrating with third-party services that require authentication. Once configured, this connection can then be used within the invokeURL Deluge task to interact with the external service.

When does this change take effect?
This change is scheduled to roll out on September 15, 2025. We strongly encourage you to make the necessary adjustments well in advance to ensure uninterrupted functionality.

Automatic revocation of inactive connections

Any connection that hasn't been used anywhere (such as in functions) for a period of 6 months will be automatically revoked moving forward. These connections will still appear under the My Connections section but will be shown in a disconnected state. 

When does this change take effect?
This update will be rolled out on October 10, 2025. From then on, the six-month inactivity period will begin to be tracked for all connections.

Why is this changing?
This measure is a proactive step to prevent unauthorized access through dormant integrations.

What you need to do
If a connection you intend to use has been inactive for 6 months and gets revoked, you will simply need to re-authenticate it to resume its functionality. To do this, simply hover over it in the My Connections section and click the Connect button. You'll be redirected to the service's authentication page, where you can follow the required steps to re-authenticate and restore access.

We understand that these changes require some adjustments, but they are critical steps to enhance the security and reliability of Deluge.

If you have any questions or require assistance with this change, please don't hesitate to contact support@zohodeluge.com.

Sincerely, 
The Zoho Deluge Team

    • Sticky Posts

    • Function #41: Sync Associated Subforms!

      Welcome back everyone! The last custom function showed how to update a Contact with Product details from it's Related list in Deals. This week, let's look at a function that lets you update subform records in two modules simultaneously when one of them is updated. Business scenario Let's look at how subform helps in an education institution that has deployed Zoho CRM. National Public School, Austin (made up, of course!) has set up Zoho CRM and it follows the same relationship pattern of "Students",