0

I am sure there is a best-practice way to handle this, but I don't know what it is...

The situation is that I am about to submit my Salesforce package for security review. The package works by requiring an admin to grant OAuth permissions to an external web service (my site) on behalf of users in their org. When users use the plugin, it sends a signed post request to an endpoint on our site, and our endpoint responds with a page to embed in a Salesforce Canvas. My question is, what URL do I put for the external endpoint: staging or production?

If I put the staging url, then after the security team reviews the app, I'll need to re-release the managed package (since I can't edit already released packages) to point at the production domain rather than the staging domain. And if I put the production url on the first go, then the security team will be testing the plugin against our production server, which also doesn't feel quite right.

What is the proper way to handle this?

Improve this question

3 Answers 3

Reset to default
2

I'd go for something configurable. At minimum, a custom setting that's set to production by way of a post-install step. For example, adding a configuration link that admins can use after install to switch to a live mode.

Improve this answer
2
  • Hi, I'm very new to Salesforce development. Could you give me some guidance on how to implement that? The setting that we need to make configurable is the "Canvas App URL" setting on the Connected Apps page (this is the URL that Salesforce makes a signed POST request to).
    – Joshua Reback
    Commented Oct 7, 2016 at 17:34
  • @JoshuaReback you might need to build two canvas app settings, one for each service. I don't know of any other way to do this. The admin will have to choose to expose the correct service to use.
    – sfdcfox ♦
    Commented Oct 7, 2016 at 18:24
0

If your code is making the request via Apex HttpRequest calls, then consider using Named Credentials that:

A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all authentication for Apex callouts that specify a named credential as the callout endpoint so that your code doesn’t have to. You can also skip remote site settings, which are otherwise required for callouts to external sites, for the site defined in the named credential.

Improve this answer
1
  • Hi Keith, thanks for the response. We are not using Apex HttpRequest calls to this endpoint -- this endpoint is configured in "Canvas App URL" settings on the Connected Apps page....like it's just a form that we fill out, no Apex code. Let me know if you think there's a solution.
    – Joshua Reback
    Commented Oct 7, 2016 at 17:39
0

You should put the production endpoint in the package installed in your test org, and then for testing the external endpoint, you can use a staging version and provide the tester with the staging URL and staging creds. Instruct the tester to not test the production endpoint.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .