0

Third-party need to send Data to Salesforce using Https post request - They cant handle token access so it must be a force.com site.

I referred an Apex class to the site (Without using VF page), by taking the URL of the site and add the /services/apexrest/< nameOfTheClass >.

I want to know -

I there a way to get from Apex (not JS) the URL of the third-party who tried to get the service?

I need this URL because they cant supply an IP, and they want us to handle the access by the source domain from the URL...

What are the disadvantages of using a URL instead of an IP address?

Many thanks.

1 Answer 1

1

You should never use a domain from which a request originates as a way of "authentication", as a it doesn't provide any means of security and can easily be bypassed.

IP whitelisting is indeed the more secure way to go, as even though an IP address from which a request is sent CAN be spoofed, it will never receive any data back, since it will be sent back to the "legitimate" client with that particular IP address.

5
  • Thank you for your detailed response. And although all, there is a way to check the URL domain within apex? I just want to know if there is any method that can have this data on the sender.
    – Salvation
    Commented Feb 11, 2020 at 9:05
  • It is still not clear for me, what you mean by URL? You can get all the HTTP request headers using this approach. Using URLClass, allows you to get details on the URL/Domain of your org. Commented Feb 11, 2020 at 9:09
  • I would like to have data about the sender URL. I didn't see any method from the URLClass that provide the data about the sender.
    – Salvation
    Commented Feb 11, 2020 at 9:12
  • This is why you need to check the headers, looking for 'referer'-header value. I am still concerned about your approach to security, and will strongly discourage this practice. Commented Feb 11, 2020 at 9:17
  • Thanks a lot. I will not use the URL approach. I took your advice as the best practice - I just wanted to know if there a way to achieve it via apex. Thanks again :)
    – Salvation
    Commented Feb 11, 2020 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .