I am trying to scan my application in Chimera portal, I have logged into the portal and downloaded the abuse prevention token. Now I am not understanding where to upload it. In portal it says "You must upload the token to the root of the target site or its parent domain."

I am not understanding this point, can anyone explain with an example. Also in New Scan what will be the Target. (Say I have a managed package which I want to post on App Exchange, here what will be my Target).

Thanks in advance. I am new to this, please help.

  • pradeep, How did you test your web application using chimera – SFDC Dec 11 '17 at 10:10

Its important to understand that Chimera scan assumes you own the site or the app (Note its not your force.com app but an external app thats integrated with the force.com app)you are scanning .It implies you have built the external app (Not force.com app) and you have access to the root of the application .

Look at this answer to get a feel how this can be done for Node.js application .Same can be applied to Java or php apps .You need to keep the token file in the root folder .

The target there is your site url .Again not your force.com URL .Lets say your force.com app integrates with a website https://www.sample.com then the target will be https://www.sample.com.

Note that Chimera Report is needed for only external apps and in case you do not have access to the code base of the application you are integrating(lets say amazon or google API) then submit a ZAP report or if your client is ready to spend some $$$ you can go for BURP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.