---
title: "Security edge cases"
slug: "security-edge-cases"
updated: 2026-09-11T14:39:40Z
published: 2026-09-11T14:39:40Z
canonical: "help.quickbase.com/security-edge-cases"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.quickbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security edge cases

## Security update edge cases

> [!NOTE]
> Note
> 
> This article pertains to new Quickbase updates that enable enhanced security. For more information about these features, see [POST Temporary Token](/v1/docs/post-temporary-token-from-a-quickbase-field).

In this article, we discuss changing your formula fields in your Quickbase apps to meet the upcoming security changes and help keep your data secure.

If you have questions or need help changing any of these fields to be compliant with our new security measures, [submit a technical support case](https://help.quickbase.com/docs/get-help-from-quickbase-technical-support).

## Edge cases

### Lookup buttons

If you have a button or field that goes to one of our extensions but is a **lookup field from a different table**, you need to follow this portion of the guide.

We recommend against pulling the buttons themselves down in a relationship—instead, any of the fields used within the button should be pulled down as lookups.

Next, create a **Formula Rich-Text** field on the child table. This is the button replacement. Unfortunately, there is no way to use a Formula URL field instead—it must be a Formula Rich-Text.

Next, you should copy and paste the original formula into this new formula. You need to fix any field references as mentioned—likely using lookups instead.

So, you should have a formula looking like this:

![Formula example showing the POSTTempToken CSS class and data-tempTokenDBID attribute](https://cdn.document360.io/dd260e4e-10bb-4b66-8fb3-5504c272b904/Images/Documentation/671ff521af-image_8_.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A15Z&se=2026-11-04T03%3A54%3A15Z&sr=c&sp=r&sig=jCwYtGcKsXTtwLJfu6axwGAwqm2%2FGkVOQZk%2FcfV9Q5s%3D)

If you don't have the rich-text portion at the bottom, add the following. At the end of the paste-able snippet, you can swap out *Generate EFP Document* for whatever you want the button to show as its name.

```plaintext
"<a class='Vibrant Success OpenAsPopup POSTTempToken'  style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" >Generate EFP Document</a>"
```

You then need to change the portion in the rich-text at the bottom for `data-tempTokenDBID`—it should be set to whatever the `msdb` (or `mrgdbid` if applicable) is.

For the above example, it should be `data-tempTokenDBID='" &amp; [_DBID_File_Repo] &amp; "'`

As another example, it could be set to `data-tempTokenDBID='bs80xqir1'` if the msdb was set to a DBID string.

After that, you should be good to go.

### Cross-table target button

If you have a button that has either the `msdb` or `mrgdbid` parameter set to a different table's DBID than the table where the button lives, you need to follow this portion of the guide.

If your button is a URL button, create another field and make it a **Formula Rich-Text** field. This is the only way to support cross-table targeted buttons.

Next, you should copy and paste the original formula into this new formula.

So, you should have a formula looking like this:

![Formula example showing the POSTTempToken CSS class and data-tempTokenDBID attribute](https://cdn.document360.io/dd260e4e-10bb-4b66-8fb3-5504c272b904/Images/Documentation/671ff521af-image_8_.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A15Z&se=2026-11-04T03%3A54%3A15Z&sr=c&sp=r&sig=jCwYtGcKsXTtwLJfu6axwGAwqm2%2FGkVOQZk%2FcfV9Q5s%3D)

If you don't have the rich-text portion at the bottom, add the following. At the end of the paste-able snippet, you can swap out *Generate EFP Document* for whatever you want the button to show as its name.

```plaintext
"<a class='Vibrant Success OpenAsPopup POSTTempToken'  style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" >Generate EFP Document</a>"
```

You then need to change the portion in the rich-text at the bottom for `data-tempTokenDBID`—it should be set to whatever the `msdb` (or `mrgdbid` if applicable) is.

For the above example, it should be `data-tempTokenDBID='" &amp; [_DBID_File_Repo] &amp; "'`

As another example, it could be set to `data-tempTokenDBID='bs80xqir1'` if the msdb was set to a DBID string.

After that, you should be good to go.

### Nested HTML in link

If you have a rich-text formula field and you have stylized it to look the exact way you want, there is a chance that you have added more HTML elements into the formula. Under certain situations, these other elements disable the POSTing functionality. Specifically, if you added any other HTML elements within the <a></a> tags, it breaks the functionality. Here's an example:

```plaintext
"<a class='Vibrant Success OpenAsPopup POSTTempToken'  style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" ><b>Generate EFP Document</b></a>"
```

The `&lt;b&gt;...&lt;/b&gt;` was added for bolding purposes. However, due to the way this changes the element, it doesn't fire the necessary events to trigger the POSTing functionality. You must remove any and all inner HTML in the `&lt;a&gt;...&lt;/a&gt;`—it can only be text.

### Formula API redirects to different tables

If you have a button that links to the Quickbase API before going to our extension, and the API call goes to a table different than the table where the field lives, you need to follow this portion of the guide.

First, consider whether this flow is necessary. We suggest you avoid this flow if possible.

The only way to now support this flow is to use the following code-page, and to modify your formula to use the code-page instead of linking to the Quickbase API and our extension directly.

First, create a code-page using the following code:

```plaintext
<!DOCTYPE html>
			<html>
			<head>
			  <meta charset="utf-8" />
			  <title></title>
			</head>
			<body>
			  <script>

    const queryString = window.location.search;
			    const urlParams = new URLSearchParams(queryString);

    //run a URL directly through fetch
			    async function RunXMLAPI(url) {
			      //generic header
			      var headers = {
			        'User-Agent': 'XML_API_Pre-Action_for_Quickbase_Extensions',
			        'Content-Type': 'application/xml'
			      }

      //fetch URL with POST, most of the XML API is suggested with POST
			      const response = await fetch(url, {
			        method: 'POST',
			        headers: headers,
			      });
			      //if there was an error, navigate over to the URL so that it displays the exact DOM as it would have before
			      if (response.status != 200) {
			        location.href = url;
			      }
			      return;
			    }

    //get the temp token for a given DBID
			    async function GetTempToken(dbid) {
			      var headers = {
			        'QB-Realm-Hostname': window.location.origin,
			        'User-Agent': 'Temporary_Token_For_Quickbase_Extensions',
			        'QB-App-Token': '',
			        'Content-Type': 'application/json'
			      };

      //get the token
			      const response = await fetch('https://api.quickbase.com/v1/auth/temporary/' + dbid, {
			        method: 'GET',
			        headers: headers,
			        credentials: 'include'
			      });
			      const token = await response.json();
			      //return the token
			      return token;
			    }

    //get temporary token for given DBID and form-submit redirect to the add-on
			    async function RunAddonWithTempToken() {

      const form = document.createElement('form');    //create a form
			      form.method = 'POST';    //set action to POST so we can include the temp token
			      form.action = window.atob(urlParams.get('exturl'));    //set the URL to direct the form submission to
			      form.rel = "noopener noreferrer";

      let token = await GetTempToken(urlParams.get('extdbid'));    //get the token

      const tempTokenInput = document.createElement('input'); //set an input element to have the temp token
			      tempTokenInput.type = 'hidden';
			      tempTokenInput.name = "TempToken";  //name needs to be TempToken here as to match up properly
			      tempTokenInput.value = token.temporaryAuthorization;    //set the value
			      form.appendChild(tempTokenInput);    //append the input into the form

      document.body.appendChild(form);    //put the form into the body
			      form.submit();  //submit the form
			    }

			    window.onload = async function (e) {
			      try {
			        if (urlParams.get('exturl') == "" || urlParams.get('exturl') == null || urlParams.get('extdbid') == "" || urlParams.get('extdbid') == null) {
			            document.getElementById("message").textContent = "The URL is missing necessary parameters. Please contact your app administrator."
			            return;
			        }

        let apicallparam = urlParams.get('apicall');
			        if (apicallparam != "" && apicallparam != null) {    //if we have an api call to execute...
			            let xmlAPICalls = window.atob(apicallparam);  //grab the API call parameter
			              await RunXMLAPI(xmlAPICalls);    //execute it - wait for it to finish
			        }

			        RunAddonWithTempToken();  //go form-submit to the add-on
			      } catch (Exception) {
			        document.getElementById("message").textContent = "An error has occurred. Please contact your app administrator."
			        console.log(Exception);    //log exception
			      }

    }

  </script>

  <div>
			    <span id="message">Please wait while the page loads...</span>
			  </div>

			</body>
			</html>
```

Note the Page ID of this code-page so you can link to it in your formula.

Next, you will change your formula to link to this code-page. For example, instead of the following formula:

![Formula linking directly to the Quickbase API and the extension](https://cdn.document360.io/dd260e4e-10bb-4b66-8fb3-5504c272b904/Images/Documentation/5ab256de41-image_6_.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A15Z&se=2026-11-04T03%3A54%3A15Z&sr=c&sp=r&sig=jCwYtGcKsXTtwLJfu6axwGAwqm2%2FGkVOQZk%2FcfV9Q5s%3D)

You convert it to:

![Formula updated to link to the code-page instead of the Quickbase API directly](https://cdn.document360.io/dd260e4e-10bb-4b66-8fb3-5504c272b904/Images/Documentation/0097eb82dd-image_7_.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A15Z&se=2026-11-04T03%3A54%3A15Z&sr=c&sp=r&sig=jCwYtGcKsXTtwLJfu6axwGAwqm2%2FGkVOQZk%2FcfV9Q5s%3D)

Make sure to replace `pageID=4` with the correct PageID that you created for the code-page earlier.

The `extdbid` parameter should match the DBID from the extension's URL parameters.

If you have questions or need help changing any of these fields to be compliant with our new security measures, [submit a technical support case](https://help.quickbase.com/docs/get-help-from-quickbase-technical-support).