Prevent lightning Community user navigating to standard Salesforce page by hacking URL

Question

I have a situation where community user can edit the URL and access standard Salesforce record page by using the query parameters. I want to control it. This is somewhat related to the discussion on here but my scenario is between Lightning Community and Lightning Experience Salesforce UI. For example my community page URL is => https://communityURL/s/view-activity?c__activityId=a07r00000021c3YAAQ. A smart portal user can easily copy the record Id query param and modify the URL to https://communityURL/s/a07r00000021c3YAAQ. This opens up a standard record page for the user.

In VF/classic we used to assign a Home page layout with a redirect URL vf page to the user so as soon as they access any internal record, they get redirected. Any idea on how to handle this in Lightning?

Answer 1

I would recommend you not to expose salesforce record Id on the community URL directly, which will make your application vulnerable.

Looking at your example I believe view-activity is a custom community page hosting some custom component.

Here are few recommendations that might help-

• Use atob and btoa base 64 encoding options and sanitize the url, so that the record ID will not be directly exposed.
• On your custom component init() you can put some logic for atob and btoa encoding to retrieve the actual ID back.

for example :

btoa('a07r00000021c3YAAQ'); -> YTA3cjAwMDAwMDIxYzNZQUFR
atob('YTA3cjAwMDAwMDIxYzNZQUFR') -> a07r00000021c3YAAQ

• On top of this you can have a client side check as @Jake Richter has already mentioned to his answer.

Answer 2

In the Experience Builder, there's a page called, "Record Detail". Drop a custom lightning component anywhere on that page that will redirect your users where you want them to go. You'd use the init handler on an Aura component or connectedCallback in an lwc.

A down and dirty Aura component could look like this.

myRecordRedirect.cmp:

<aura:component implements="forceCommunity:availableForAllPageTypes, force:hasRecordId" >
    <aura:handler name="init" value="{!this}" action="{!c.doInit}" />
</aura:component>

myRecordRedirectController.js

doInit: function(cmp, evt, helper) {
  const recordId = component.get('v.recordId');
  // some logic to only do this for specific object types
  if (recordId.startsWith('a07') {
    window.location.href = 'https://communityURL/s/view-activity?c__activityId=' + recordId;
  }
}

For an lwc, you'd do something similar, but you'd leverage the connectedCallback.

Answer 3

You should be able to define a page layout that has VF section that redirects to your home page when the page is loaded. This should still work in Lightning/Communities as it would display the VF in an iFrame. Then you just assign that layout to your community users.