I have a simple nodejs app that oAuths in the backend and sends out sessionId to the front-end. Which then goes on to create a "Lightning-out" component. But accessing session Id on client side seems unsecure to me. A hacker can use it. Is there was to just inject lightning component from backend to front end without revealing any authentication detail at-all , including session Id?


  • 1
    I do not think there is any security threat here . We are using sessionId and not access token or refresh token or user credentials . Any web app stores session Id on the cookie of the browser .Infact one can easily get the salesforce session id from the browser . As long as there is session expiration set on your connected application you are good .If you want an extra layer of security you can create a high insurance session on the connected app via a checkbox that will reinforce the user to log in if he changes the browser . – Mohith Shrivastava Jan 27 '17 at 4:46
  • Also as soon as user switches IP ,salesforce will block them – Mohith Shrivastava Jan 27 '17 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.