AWS connect: Amazon Connect interactive messages: HTTPS, input validation, and size limits
Summary
Adds Apple Messages for Business constraints to the interactive messages reference: HTTPS required for all URLs (image, Apple Pay endpoints, appIconUrl), requestIdentifier must be a valid RFC 4122 UUID and must not contain '../', '"', or "'", plus new 200-character string limits, image format/size limits (PNG, 200 KB, 5 MB), and a 20-item lineItems cap.
Security assessment
The requestIdentifier restriction explicitly forbids '../', '"', and "'" characters, which is concrete input-validation hardening against path traversal and injection; the change also mandates HTTPS for all Apple Messages for Business URLs (image, payment gateway, fallback, order tracking, appIconUrl), enforcing encryption in transit and rejecting HTTP payloads with a validation error.
Evidence
| **requestIdentifier** | No | | | String. Must be a valid RFC 4122 UUID in canonical form (for example, `550e8400-e29b-41d4-a716-446655440000`). The `requestIdentifier` must not contain the characters `../`, `"`, or `'`. If not specified, a UUID will be generated and used.
Diff
diff --git a/connect/latest/adminguide/interactive-messages.md b/connect/latest/adminguide/interactive-messages.md index e22db17..1bf07a6 100644 --- a//connect/latest/adminguide/interactive-messages.md +++ b//connect/latest/adminguide/interactive-messages.md @@ -35,0 +36,2 @@ When using interactive messages with the [Apple Messages for Business](./apple-m + * Images must be in PNG format. Connect Customer automatically converts non-PNG images (such as JPEG) to PNG and resizes them to fit within the 200 KB limit. If an image cannot be resized to 200 KB or less, Connect Customer will drop the image from the message. + @@ -37,0 +40,6 @@ When using interactive messages with the [Apple Messages for Business](./apple-m + * The total ImageItem dictionary (including Base64-encoded image data) must not exceed 5 MB. If the total image data in a single message exceeds 5 MB, Connect Customer drops excess images to stay within Apple's budget. + + + + +###### HTTPS required for Apple Messages for Business @@ -38,0 +47 @@ When using interactive messages with the [Apple Messages for Business](./apple-m +All URLs included in Apple Messages for Business interactive message payloads must use HTTPS. Examples include image URLs (`imageData`), Apple Pay payment endpoints (`paymentGatewayUrl`, `fallbackUrl`, `orderTrackingUrl`, and similar fields), and iMessage App icon URLs (`appIconUrl`). @@ -39,0 +49,5 @@ When using interactive messages with the [Apple Messages for Business](./apple-m +Connect Customer rejects payloads containing HTTP URLs with a validation error. + +###### Apple Messages for Business string length limit + +When using interactive messages with the Apple Messages for Business channel, any string displayed in the Messages UI — including titles, subtitles, labels, and button text — must not exceed 200 characters. Strings that exceed this limit are rejected with a validation error. For other channels, the limits shown in the following individual template tables continue to apply. @@ -150 +164 @@ replyMessage | No | | | -**content** | **title** | Yes | 1 | 5000 | Should be a description for promptless templates +**content** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | Should be a description for promptless templates @@ -152 +166 @@ replyMessage | No | | | -subtitle | No | 0 | 5000 | +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -170,2 +184,2 @@ templateIdentifier | No | | | Number. Should be an UUID. **This field is requi -**elements** | **title** | Yes | 1 | 5000 | -subtitle | No | 0 | 5000 | +**elements** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -176,2 +190,2 @@ actionDetail | No | | | Only required for action button feature. Must be "PRE -replyMessage | **title** | Yes | 1 | 5000 | -subtitle | No | 0 | 5000 | +replyMessage | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -278,2 +292,2 @@ Parent field | Field | Required | Minimum characters | Maximum characters | Othe -replyMessage | **title** | Yes | 1 | 5000 | Should be description for promptless templates -subtitle | No | 0 | 5000 | +replyMessage | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | Should be description for promptless templates +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -283 +297 @@ imageDescription | No | 0 | 50 | Cannot exist without an image -**content** | **title** | Yes | 1 | 5000 | Should be description for promptless templates +**content** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | Should be description for promptless templates @@ -293 +307 @@ location | **longitude** | Yes | -180 | 180 | Must be [double](https://en.wikip -**title** | Yes | 1 | 5000 | +**title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | @@ -358,2 +372,2 @@ Parent field | Field | Required | Minimum characters | Maximum characters | Othe -**content** | **title** | Yes | 1 | 5000 | Should be a description for promptless templates -subtitle | No | 0 | 5000 | +**content** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | Should be a description for promptless templates +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -369 +383 @@ templateIdentifier | No | | | Number. Should be an UUID. **This field is requi -**elements** | **title** | Yes | 1 | 5000 | +**elements** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | @@ -371,2 +385,2 @@ templateIdentifier | No | | | Number. Should be an UUID. **This field is requi -replyMessage | **title** | Yes | 1 | 5000 | -subtitle | No | 0 | 5000 | +replyMessage | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | +subtitle | No | 0 | 5000 (200 for Apple Messages for Business) | @@ -419 +433 @@ replyMessage | No | | | -**content** | **title** | Yes | 1 | 5000 | Should be a description for promptless templates +**content** | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | Should be a description for promptless templates @@ -422 +436 @@ replyMessage | No | | | -replyMessage | **title** | Yes | 1 | 5000 | +replyMessage | **title** | Yes | 1 | 5000 (200 for Apple Messages for Business) | @@ -676,9 +690,9 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**title** | String | Yes | Top-level title of the form. Displayed in Apple receive message bubble and transcript rendering -**subtitle** | String | No | Used as subtitle in ReceivedMessage -**imageType** | String | No | Valid values: "URL" Used for image in ReceivedMessage -**imageData** | String | No | S3 image url Used for image in ReceivedMessage -**pages** | AppleFormPage[] | Yes | List of form pages -**showSummary** | Boolean | No | Whether to display a summary page of responses to review before submission Default: False (no confirmation/summary page) -**splashPage** | AppleFormSplashPage | No | Initial splash page to display before actual pages Default: No splash page +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**title** | String | Yes | 200 | Top-level title of the form. Displayed in Apple receive message bubble and transcript rendering +**subtitle** | String | No | 200 | Used as subtitle in ReceivedMessage +**imageType** | String | No | | Valid values: "URL" Used for image in ReceivedMessage +**imageData** | String | No | | S3 image url Used for image in ReceivedMessage +**pages** | AppleFormPage[] | Yes | | List of form pages +**showSummary** | Boolean | No | | Whether to display a summary page of responses to review before submission Default: False (no confirmation/summary page) +**splashPage** | AppleFormSplashPage | No | | Initial splash page to display before actual pages Default: No splash page @@ -688,7 +702,7 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**title** | String | Yes | Title of splash page -**subtitle** | String | No | Subtitle / body of splash page -**imageType** | ImageType | No | Present when displaying image within splash page Allowed value: "URL" Default: No image displayed -**imageData** | String | No | For imageType="URL", this is the URL value Default: No image displayed -**buttonTitle** | String | Yes | Text of Continue button. Required by Apple, default text with localization not supported +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**title** | String | Yes | 200 | Title of splash page +**subtitle** | String | No | 200 | Subtitle / body of splash page +**imageType** | ImageType | No | | Present when displaying image within splash page Allowed value: "URL" Default: No image displayed +**imageData** | String | No | | For imageType="URL", this is the URL value Default: No image displayed +**buttonTitle** | String | Yes | 200 | Text of Continue button. Required by Apple, default text with localization not supported @@ -703,5 +717,5 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**pageType** | ApplePageType | Yes | Enum for page type. Allowed values: ["Input", "DatePicker", "WheelPicker", "ListPicker"] -**title** | String | Yes | Page title -**subtitle** | String | Yes | Page subtitle. Used in confirmation page +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**pageType** | ApplePageType | Yes | | Enum for page type. Allowed values: ["Input", "DatePicker", "WheelPicker", "ListPicker"] +**title** | String | Yes | 200 | Page title +**subtitle** | String | Yes | 200 | Page subtitle. Used in confirmation page @@ -713,9 +727,9 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**pageType** | ApplePageType | Yes | Value: "DatePicker" -**labelText** | String | No | Text displayed next to the date input. See example screenshots in Appendix -**helperText** | String | No | Helper text displayed under the date input. See example screenshots in Appendix Default: No helper text -**dateFormat** | String | No | ISO 8601 date format. Default: MM/dd/yyyy -**startDate** | String | No | Initial / default selected date in valid date format Default: Current date for end user when message is sent -**minDate** | String | No | Min date allowed to be selected in valid date format Default: No min -**maxDate** | String | No | Max date allowed to be selected in valid date format Default: Current date for end user when message is sent +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**pageType** | ApplePageType | Yes | | Value: "DatePicker" +**labelText** | String | No | 200 | Text displayed next to the date input. See example screenshots in Appendix +**helperText** | String | No | 200 | Helper text displayed under the date input. See example screenshots in Appendix Default: No helper text +**dateFormat** | String | No | | ISO 8601 date format. Default: MM/dd/yyyy +**startDate** | String | No | | Initial / default selected date in valid date format Default: Current date for end user when message is sent +**minDate** | String | No | | Min date allowed to be selected in valid date format Default: No min +**maxDate** | String | No | | Max date allowed to be selected in valid date format Default: Current date for end user when message is sent @@ -737,5 +751,5 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**title** | String | Yes | Display text of item -**imageType** | ImageType | No | Present when displaying image within item Allowed value: "URL" Default: No image displayed -**imageData** | String | No | For imageType="URL", this is the URL value Default: No image displayed +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**title** | String | Yes | 200 | Display text of item +**imageType** | ImageType | No | | Present when displaying image within item Allowed value: "URL" Default: No image displayed +**imageData** | String | No | | For imageType="URL", this is the URL value Default: No image displayed @@ -751,5 +765,5 @@ Similar image model to existing interactive message models (ListPicker), except -Field | Type | Required | Description / Notes ----|---|---|--- -**pageType** | ApplePageType | Yes | Value: "WheelPicker" -**items** | AppleFormWheelPickerPageItem[] | Yes | List of wheel picker items -**labelText** | String | No | Text displayed next to the input. See example screenshots in Appendix +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**pageType** | ApplePageType | Yes | | Value: "WheelPicker" +**items** | AppleFormWheelPickerPageItem[] | Yes | | List of wheel picker items +**labelText** | String | No | 200 | Text displayed next to the input. See example screenshots in Appendix @@ -761,3 +775,3 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**title** | String | Yes | Display text of picker item +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**title** | String | Yes | 200 | Display text of picker item @@ -769,13 +783,13 @@ Field | Type | Required | Description / Notes -Field | Type | Required | Description / Notes ----|---|---|--- -**pageType** | ApplePageType | Yes | Value: "Input" -**labelText** | String | No | Text displayed next to the input box. See example screenshots in Appendix -**helperText** | String | No | Additional text displayed under input box Default: No helper text -**placeholderText** | String | No | Placeholder text to display initially when there's no input Default: "(Optional)" or "(Required)" placeholder text -**prefixText** | String | No | Prefix text to display next to input. Ex: '$' when input is monetary value Default: No prefix text -**required** | Boolean | No | Whether end user is required to provide input Default: false -**multiLine** | Boolean | No | Whether multi-line input can be provided Default: false (single line) -**maxCharCount** | Number | No | Max char count of input. Enforced on Apple client Default: No limit -**regex** | String | No | Regex string to place constraints on input provided Default: No regex constraints -**keyboardType** | String | No | Determines what type of keyboard is displayed when end user is providing input Allowed values: Same as Apple. See [docs](https://register.apple.com/resources/messages/msp-rest-api/type-interactive#form-message). Some of the allowed values: numberPad, phonePad, emailAddress -**textContentType** | String | No | Helps with auto-fill suggestions on Apple device. Allowed values: Same as Apple. See [docs](https://register.apple.com/resources/messages/msp-rest-api/type-interactive#form-message). Some of the allowed values: telephoneNumber, fullStreetAddress, familyName +Field | Type | Required | Maximum characters | Description / Notes +---|---|---|---|--- +**pageType** | ApplePageType | Yes | | Value: "Input" +**labelText** | String | No | 200 | Text displayed next to the input box. See example screenshots in Appendix +**helperText** | String | No | 200 | Additional text displayed under input box Default: No helper text +**placeholderText** | String | No | 200 | Placeholder text to display initially when there's no input Default: "(Optional)" or "(Required)" placeholder text +**prefixText** | String | No | 200 | Prefix text to display next to input. Ex: '$' when input is monetary value Default: No prefix text +**required** | Boolean | No | | Whether end user is required to provide input Default: false +**multiLine** | Boolean | No | | Whether multi-line input can be provided Default: false (single line) +**maxCharCount** | Number | No | | Max char count of input. Enforced on Apple client Default: No limit +**regex** | String | No | | Regex string to place constraints on input provided Default: No regex constraints +**keyboardType** | String | No | | Determines what type of keyboard is displayed when the end user is providing input. Allowed values: `default`, `asciiCapable`, `numbersAndPunctuation`, `URL`, `numberPad`, `phonePad`, `namePhonePad`, `emailAddress`, `decimalPad`, `webSearch`. Unsupported values (such as `UIKeyboardTypeTwitter`) will be transformed to `default`. +**textContentType** | String | No | | Helps with auto-fill suggestions on Apple device. Allowed values: Same as Apple. See [docs](https://register.apple.com/resources/messages/msp-rest-api/type-interactive#form-message). Some of the allowed values: telephoneNumber, fullStreetAddress, familyName @@ -926,2 +940,2 @@ Parent field | Field | Required | Minimum characters | Maximum characters | -**content** | **title** | Yes | 1 | 512 | The title of the received message bubble -| **subtitle** | No | 0 | 512 | Subtitle to be displayed under title of the received message bubble +**content** | **title** | Yes | 1 | 200 | The title of the received message bubble +| **subtitle** | No | 0 | 200 | Subtitle to be displayed under title of the received message bubble @@ -931 +945 @@ Parent field | Field | Required | Minimum characters | Maximum characters | -| **requestIdentifier** | No | | | String, An identifier for the ApplePay request. If not specified, an UUID will be generated and used. +| **requestIdentifier** | No | | | String. Must be a valid RFC 4122 UUID in canonical form (for example, `550e8400-e29b-41d4-a716-446655440000`). The `requestIdentifier` must not contain the characters `../`, `"`, or `'`. If not specified, a UUID will be generated and used. @@ -935,6 +949,6 @@ Parent field | Field | Required | Minimum characters | Maximum characters | -**endpoints** | **paymentGatewayUrl** | Yes | | | String. Called by Apple Pay to process the payment through the payment provider. The URL should match the URL in the initiativeContext field of the merchant session -| **fallbackUrl** | No | | | A URL that opens in a web browser so the customer can complete the purchase if their device is unable to make payments using Apple Pay. If specified, fallbackUrl need to match paymentGatewayUrl. -| **orderTrackingUrl** | No | | | Called by Messages for Business after completing the order; provides you with an opportunity to update the order information in your system.