Questions tagged [security]
Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.
911
questions
0
votes
1
answer
23
views
Can we apply user-level security on the Javascript controller file and the helper file of a lightning component?
I have a lightning component with its associated javascript controller and helper. Now I have the requirement to make the javascript controller and the helper read-only. Can anyone give me an idea to ...
- 258
1
vote
3
answers
3k
views
Welcome Email not getting sent to community users on register
I have run into an issue where if I am unchecking a checkbox: 'Let guest users see other members of this community' under general setting in Preferences.
If the check box is checked, welcome emails ...
- 293
0
votes
2
answers
2k
views
PMD Security error - Apex Suggest Using Named Cred
I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code.
Blob headerValue = Blob.valueOf(username + ':' + password);
String authorizationHeader = '...
- 1,035
0
votes
0
answers
320
views
stripinaccessible stripping fields for system administrator
I have a generic function to validate CRUD before DML which uses stripInaccessible().
public static SObjectAccessDecision validateCRUD(AccessType access, List<SObject> records, Boolean ...
- 315
4
votes
2
answers
1k
views
Tightening security around Javascript Remoting from Visualforce
We have a community portal built off of Visualforce pages and on those pages we do a lot of Javascript Remoting. Due to the complexity of our org, most of the Apex classes holding these remote methods ...
- 497
2
votes
1
answer
435
views
Using isSet() vs getRemovedFields() to identify inaccessible fields after stripInaccessible()
I am wondering is there a difference between isSet() and getRemovedFields() to identify inaccessible fields that were removed by the stripInaccessible() method.
From the official documentation Enforce ...
- 5,129
1
vote
1
answer
969
views
use post requests for cross-domain sessions - session setting
I have enabled this session setting in my sandbox org. I did not see any difference interms of impacts to my system.which areas it will affect our system
What i need to test before moving it to the ...
- 13
1
vote
1
answer
76
views
Summer 20 Release Guest Site - allow create custom object
We have a force.com site that has numerous VF pages to create a custom object. The Summer 20 release report says that we need to / will be forced to shut down access. I see that one can create sharing ...
- 773
3
votes
1
answer
1k
views
What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent?
This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present ...
- 2,071
2
votes
0
answers
176
views
How can I detect in Apex code that a user has or doesn't have access to the custom setting?
I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings.
Now I expect that a code in user context (Anonymous Execution Window) would ...
- 16.8k
3
votes
2
answers
927
views
Inherited Sharing not respected in trigger context
I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
- 1,647
1
vote
1
answer
165
views
How quickly are updates to Custom Metadata Types committed?
In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/...
- 2,071
1
vote
1
answer
1k
views
Lock a Field on a Record based off of Profile
I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
- 3,461
0
votes
0
answers
36
views
Set-up a File Location that is not on a standard port
According to documentation Marketing Cloud will only allow connections on the stardard 21/22 ports. The client has a security policy that doesn't allow access to standard ports.
https://help....
- 1,808
4
votes
2
answers
2k
views
What is the impact of enabling the critical update 'Route My Domains Through Salesforce Edge'?
Based on the documentation, it'll use Machine Learning to improve connectivity and performance --> so is this going to switch Salesforce login by default to Edge?
- 43
3
votes
1
answer
180
views
Is there a way to make field level data classification required before creating a new custom field?
End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted.
...
0
votes
0
answers
361
views
Custom Setting vs. Custom Object vs. Custom Metadata Type for Multiple Environment Credentials [duplicate]
I am looking to confirm the best practice of storing client / secret credentials for multiple environments for multiple external webservices within salesforce.
Below is the analysis I have done ...
- 2,071
6
votes
1
answer
9k
views
Install for "All Users" vs "Admin Only" (Salesforce CPQ)
I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
- 3,554
0
votes
2
answers
534
views
How can I find the Secure URL for the public site by Apex?
We are using the following code to find the Secure URL for the public site by Apex
List<String> siteFullUrlList = new List<String>();
List<Site> siteList = [
...
- 16.8k
0
votes
1
answer
462
views
"https://sforgcompare.herokuapp.com/"Is this trusted tool for Salesforce org comparing sandbox to sandbox and sandbox to production [closed]
"https://sforgcompare.herokuapp.com/" is this trusted tool, any other tools for org comparing in Salesforce.
Your comments/suggestions would be greatly appreciated.
Thank you
- 77
1
vote
1
answer
448
views
Open Page Redirect Issue
We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability.
Id id = ...
- 557
2
votes
1
answer
4k
views
Auth Provider with per-user Named Credential
I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
- 21
0
votes
1
answer
2k
views
How to pass Id in a encrypted format to public site in Salesforce?
I have created a public site where a VF page is exposed with a few URL parameter ( Id of a few objects ). Now I want to encrypt those Ids so that there is no security risk.
I was trying to achieve it ...
2
votes
1
answer
3k
views
Auditing changes made by an admin on behalf of another user
I am wondering whether we have an option/ functionality in Salesforce to store the details of the user who logs as a different user.
Use Case
I am a System Admin (User X) to a Salesforce instance ...
- 647
0
votes
1
answer
4k
views
CheckMarx FLS Create/Update Vulnerability in Salesforce Apex Code [duplicate]
I need help in fixing below vulnerabilities found in CheckMarx scan.
Scenario:
I have written a trigger on FeedItem object.
This trigger will archive the FeedItem into custom object ...
0
votes
1
answer
351
views
Salesforce Data Mask and Workflows / Process Builder deactivation
I'm trying out Salesforce's Data Mask feature and in the docs (https://help.salesforce.com/articleView?id=data_mask_considerations.htm&type=5) it mentions that all workflows (and presumably ...
- 1,256
3
votes
0
answers
194
views
Apex Row-Level Security is not applied to OwnerId field
It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement.
public with sharing class ...
- 529
1
vote
1
answer
299
views
Authentication Vulnerability Issue with Page Redirect
We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability.
public Pagereference ...
- 557
0
votes
1
answer
698
views
How to store OAuth credentials in Salesforce Securely [closed]
I have implemented a custom auth provider by following the steps from this help guide https://help.salesforce.com/articleView?id=sso_provider_plugin_custom.htm and the setup works as expected.
Now ...
- 838
7
votes
1
answer
11k
views
How to troubleshoot Exception thrown when using WITH SECURITY_ENFORCED
I've added the WITH SECURITY_ENFORCED clause to my SOQL queries. I'm testing them with a user who has a permission set that grants all object permissions (read, create, etc.), and also has read and ...
- 1,232
-1
votes
1
answer
618
views
Apex FLS Methods
I have a question regarding Salesforce FLS.
Is there any method available which dynamic check the object field-level security.
Like I have Account object and Field name Phone and pass to any ...
- 837
0
votes
0
answers
501
views
Bad Field Names on Insert Update in Integration (but not on all records in transaction)
Scenario
We have an integration that upserts records against Sobject A, C and CO. (I'm using letters to represent for brevity)
A - Account
C - Contact
CO - CustomSobject (junction Sobject between A &...
- 159
0
votes
1
answer
200
views
How can I allow a profile to only have access to user creation and nothing else
I have cloned a read only profile and removed all access except manage users. I am still able to see custom code etc in set up and configuration. How can I restrict a user from accessing everything ...
0
votes
1
answer
506
views
Apex triggers to interact with sql server [closed]
We are in the beginning stages of getting set up in Salesforce, and there is something that I am having a little trouble getting my head wrapped around;
We currently have a local SQL server ...
- 103
0
votes
1
answer
103
views
New Button on Account overriden with Lightning Component
I have overriden 'New' button on Account with an aura component. So when a user clicks on New button , all the Account record types get populated.
The issue is, user has access to only 2 record types ...
- 23
2
votes
2
answers
4k
views
Check if users email has been verified?
When the users email address is changed an email is sent to the user asking them to verify the change of the email. The user then clicks on the link and confirms the email change.
Is there anywhere ...
- 99
0
votes
1
answer
183
views
Disable Ability to Edit RecordType
I have a custom object with a Record Type that is read-only on the page layout but I can still make updates to the Record Type on the page. Why is this? I want to make the field un-editable, is there ...
- 3,461
0
votes
1
answer
220
views
Require Login to View Lightning Component
Is there a way to require login before a user can see a Lightning Component in Salesforce Community?
- 31
3
votes
0
answers
852
views
Import CA-Signed Certificate from One Org into Another via MetadataAPI
I am trying to automate the set up of some of my lower sandboxes.
In my SandboxPostCopy class, I'm using the FinancialForce MetadataAPI wrapper MetadataService to query and upsert a certificate. (...
- 2,071
1
vote
2
answers
16k
views
"You do not have access to the Apex class named ...": cannot find the cause
I have developed a Lightning Web Component in a sandbox, consisting of HTML, JS, some actions and a few Apex classes. I have tested this as sysadmin and as another non-sysadmin user. No problems.
...
- 4,047
1
vote
1
answer
590
views
Debugging best practices - callouts and security risks [closed]
What is the best practice for debugging callouts and their endpoints that are stored in custom metadata or custom settings? What are the possible threats and security risks if adding this sensitive ...
- 3,461
1
vote
1
answer
286
views
XML format for IP Ranges in Security Settings
I'm trying to use sfdx for source based development. Trying to define the range of whitelisted IPs in Security.settings-meta.xml. When I push my code to my org I get an error:
Error force-app/main/...
- 121
0
votes
1
answer
85
views
How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?
How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?
Can I check the above using AuthSession object's ...
- 61
0
votes
0
answers
101
views
Chrome states "Not Secure" when on record page with Lighting Web Components
When I navigate to a record with a Lightning Web Component, my chrome browser lists "Not Secure" in the hyperlink bar. How do I configure either the Salesforce instance or my Lightning Web Components ...
- 767
0
votes
1
answer
157
views
there an easy way to so a soql query to see the the applications a profile has access to?
I tried this query recently
SELECT Id, Name FROM AppMenuItem WHERE Id IN (SELECT SetupEntityId From SetupEntityAccess WHERE Parent.ProfileId =: id) ORDER BY Label
and got this error
The selected ...
- 133
1
vote
0
answers
62
views
Authentication via SFDC to "Approve" a record - Secure method needed [closed]
I have a unique requirement to build and am having trouble with the method to use to meet it.
Working with a science lab that wants the ability to soft lock a record (via Validation Rule) that ...
- 191
0
votes
0
answers
52
views
How to disable Settings link?
I am looking for disable the "Settings" option displayed in salesforce when clicking in the user circle for specific profiles.
Thank you all!
- 21
9
votes
1
answer
812
views
Can API access be limited to only via Apex classes?
We are building a product that offers two routes to the back-end data:
JSON calls to @RestResource Apex class APIs
LWC calls to @AuraEnabled Apex classes
Is there a profile setup that keeps these ...
- 136k
0
votes
1
answer
4k
views
Permision control of Notes and Attchments
How can we control the CREATE/READ/EDIT/DELETE permission of Notes and Attachments via Profile/Permission set?
Is the permission of Notes and Attachments govern by the parent object like Account, ...
- 49
6
votes
1
answer
610
views
Security stripInaccessible's SObjectAccessDecision getRecords() ordering
Is there a guarantee documented anywhere that the ordering of the SObjectAccessDescision's getRecords() method will match the ordering of the input list?
It seems to be the behavior but I can't see ...
- 757