I saw a JSForce code example on another site. It looks like one put their username and password in the code. Did I get that correct or is there a way to connect to SF without risking security? Can anyone explain?
Add a comment
|
2 Answers
User name and password is being populated on server side only. In your example JSForce user name and password is being used by Node.js and Command Line. In web browser you pupulate your Salesforce OAuth2 ClientID and not user name and password so that the JSForce complies security requirements.
There are other API tool-kits and tools where you need to provide username password too. Its not first and its not going to be last in near future(even though oAuth is catching up). But its up to you if you trust the 3rd party or not. If you don't then you can run it through security scanner like burp and check yourself. The other option is to review their code. Still if you are not satisfied then don't use it and write your own implementation by using SFDC REST API.
answered Mar 31, 2016 at 11:13
