I am new to salesforce development and have a question regarding the application security review process. After the installation of my application in salesforce I want to invoke a service in my java spring based app(which is hosted in cloud). I will pass salesforce organization id to the java app and it will return a string response stating success or error. Apart from the org id I will not pass any salesforce data. I want to know in this case do I need to use the "Burp" scanner or any other review of my external java app before submitting my salesforce to security review process.
4 Answers
Only your code in salesforce Instance will be evaluated as a part of security review .But its advisable to follow best practice in your Java app too.
Some of them include
Make sure your Java app does bulk retrieve and bulk update to avoid platform governor limit
Make sure you have proper error handling mechanism
answered Apr 28, 2014 at 6:32
Security review team expects burp report for the api you are sending the salesforce org-ID. Burp testing is must. The api should be accessible only on https and not on http. If you need more information regarding this issue do comment.
answered Aug 14, 2015 at 5:56
Salesforce Security review process only includes review of your apex code. But make sure you won't hit Salesforce Governor limits using java app.
If there is also a website that the customer logs into in order to get access tokens, provide payment, configure the webservice or obtain support, then you would need to use the Burp scanner on the website.
For the webservice, if it is a rest service than you can use Burp. For SOAP, there are other tools such as SOAP UI that you can use to test the webservice.
The security review is of the complete solution, not just the part of the solution hosted on Salesforce.
