2

We own a website (outside Salesforce and the code is written in PHP) which calls a third party API and get the response back. And the requirement is to integrate the response to Salesforce after receiving the response. The solution I suggested is after the website receiving the response, it can call the Salesforce REST API and we can implement the REST API at Salesforce side. But the issue is, it seems that the API call from website to SFDC can be hijacked. Though Salesforce has a mechanism only to receive api calls from a certain source, it still doesn't prevent the api call to be hijacked. How can we solve this? And is there a better (more secure) way to build this?

Improve this question
2
  • 2
    I would expect the Salesforce REST API to be secured using either the Session Id or OAuth 2.0 access token in the Authorization header. Are you doing this REST call from the client or the PHP server? In what way can it be hijacked?
    – Daniel Ballinger
    Commented May 16, 2014 at 1:48
  • @DanielBallinger We are just at the planning phase, haven't done the real coding yet. Just want to see whether this is structured in a correct way and how much does it cost to make it secure. I am supposing that the REST call is from PHP server. I am just wondering if we use that way, can the message be caught and changed before hitting salesforce?
    – Lance Shi
    Commented May 16, 2014 at 2:34

2 Answers 2

Reset to default
1

It's not clear from the question the exact security concern you have with the REST API but I believe from comments your concern is that a call to the REST API could be intercepted by someone else, modified, and then submitted.

If that's the concern, I agree with @atulrajguru9 that the more likely security vulnerability is going to come from your PHP server and application than the Salesforce REST API.

Two things to consider:

  1. All calls to the REST API are SSL encrypted which would make it difficult to intercept the API call.

  2. You can lock sessions to the IP where they originated under Setup -> Session Settings -> Lock sessions to the IP address from which they originated.

Is there something that the third party API you're already calling out to provides to security the call that the Salesforce REST API does not?

Improve this answer
0

All SFDC API are highly secured and security is top most priority for SFDC. I think you should not worry about the SFDC API. If i would be in your place i would have took all efforts to make sure that my PHP sever is secured have all updated valid certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .