1

So I need to call and create a webhook inside a third party platform. The caller code and the return url of the webhook is inside Salesforce.

So in Salesforce I need to implement a webservice for the return url. Basically, I don't think using Oauth2 login here is an option because the webhook return call won't be able to login here.

So probably I should use a site to build a public web service here? I don't see an issue with the security because the webservice will only expose minimum amount of data.

But the issue is we are building it in a managed package. I don't think we can include sites inside a package? Correct me if I am wrong.

Is there any walkaround for this?

Improve this question
4
  • Why not just send the session id along with the initial payload?
    – Adrian Larson ♦
    Dec 16, 2016 at 1:16
  • @AdrianLarson If I understand correctly, session Id is different for each Salesforce login session. So how does the webhook return webservice call obtain that?
    – Lance Shi
    Dec 16, 2016 at 1:30
  • You're calling out from Salesforce to the third party platform as the first step, no? I'm saying send it with that first payload.
    – Adrian Larson ♦
    Dec 16, 2016 at 1:45
  • @AdrianLarson I am establishing a webhook with third party at the first step which is correct. However, this webhook service is supposed to be long lasting, which means it doesn't just serve for the current session. It will be there ... for years.
    – Lance Shi
    Dec 16, 2016 at 1:47

1 Answer 1

Reset to default
1

We haven't found a way to include a Site in a managed package; the problem may be that the first step in setting up Sites is to choose a domain name that hasn't already been used.

So what we have done is include the @RestResource class in the managed package and then provided configuration instructions on how to setup the Site. Not ideal.

On the question of security, in our case it is a callback to receive SMSs from Twilio and that API includes a security hash of a secret that allows us to verify the sender.

An easy thing to forget when the @RestResource class is included in a managed package is that the URL to access it gets an extra path element of the namespace prefix of the managed package (NS here):

https://DOMAIN-developer-edition.na15.force.com/SITE/services/apexrest/NS/URLMAPPING
Improve this answer
3
  • Thank you for your answer. So using OAuth or sessionId is not even an option here, is that right?
    – Lance Shi
    Dec 16, 2016 at 10:20
  • @LanceShi For my Twilio case it wasn't relevant. From the Salesforce side you could use OAuth and as Adrian suggests you could send the session id but it all depends whether the webhook (the third party service) can be configured/progammed to do the necessary work when it calls back.
    – Keith C
    Dec 16, 2016 at 10:39
  • Thank you, Keith. It is our platform so we can pretty much programme as much as we want. But just want to make it general as well. I will investigate more.
    – Lance Shi
    Dec 16, 2016 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .