Tell me more ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.
up vote 1 down vote favorite

We currently have an integration with our external platform inside salesforce by using IFrames. For authentication we pass the Salesforce session as a query string parameter inside the IFrame address and do callback authentication from our external platform. But our client now feels this mode is insecure as we pass salesforce session id in plaintext.

Can we improve this by anyway? I also feel this is a old way of doing integration. Are there any better methods available now?

share|improve this question
your client is correct - it's insecure. Can you get away from the iframes? what are your requirements? – Saariko♦ Oct 31 '12 at 6:48
@Saariko Our requirement is to show a report at every salesforce Account Page. The data for that report comes from our external platform. – tamizhgeek Oct 31 '12 at 6:51

1 Answer

up vote 2 down vote accepted

If the iframe address is https, then the session id is secure on the wire. You could encrypt it as well, with a shared secret, but I'm not sure how much practical advantage that would give, since the browser can see the session id in the cookie anyway.

There is a new approach to this kind of integration - Force.com Canvas - but it is (as of Winter '13) still in pilot.

share|improve this answer
Oh Thanks! Our endpoint it https only. Can you give me more pointers on encrypting ourselves? – tamizhgeek Oct 31 '12 at 6:52
Like I said, I don't think you gain anything by adding another layer of encryption, but you could use the Apex Crypto class to AES encrypt the token with a shared secret. – metadaddy♦ Oct 31 '12 at 6:59
Thanks @metadaddy – tamizhgeek Oct 31 '12 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.