2

In my current implementation of an Apex REST callout code to external system , I have to set an endpoint using a Named credentials-NAMED_CRED. The Named Credential has an endpoint like -

https://xyz.com/res/login?userID=XXX&password=YYYY

I use req.setEndpoint('callout:NAMED_CRED') in my code while making a Callout. This approach is showing up in security analysis that it is not safe to send the userid and password in URL. Is there any other way I can set the credential details with out hardcoding the credentials in the COde. One of the good practice I want to follow is not to change the code when credential detail changes or endpoint has to be changed. Is there way to do this?

The code using POST:

public class jsonWrapper {
        public String userID {get; set;}
        public String Password {get; set;}
}

jsonWrapper wrap = new jsonWrapper();
wrap.userID = 'YYYY';
wrap.Password = 'xxx';
String jsonBody = json.serialize(wrap);
system.debug('JSON Body****' + jsonBody);

HttpRequest req = new HttpRequest(); 
HTTP auth = new HTTP();
HTTPRequest r = new HTTPRequest();
r.setClientCertificateName('CERT');
r.setEndpoint('https://xyz.com/login');
r.setMethod('POST');   
r.setBody(jsonBody);     

HTTPResponse authresp=new HttpResponse();
authresp = auth.send(r); 
System.debug(authresp.getBody());
system.debug(authresp);

Output I get :

17:18:04:002 USER_DEBUG [10]|DEBUG|JSON Body****{"userID":"SA-ITS-SFDCRESTUser","Password":"Ez4u2Get"}
17:18:05:446 USER_DEBUG [22]|DEBUG|{"statusCode":"1160","severity":"FATAL","statusMessage":"Required String parameter 'userID' is not present"}
17:18:05:446 USER_DEBUG [23]|DEBUG|System.HttpResponse[Status=OK, StatusCode=200]

1 Answer 1

3

Passing the credentials in the query string isn't safe. Any system that can see the request coming through can read the values straight of the request. Rather, switch to a POST request and encrypt them in the body of the message.

Better yet, switch to one of the Authentication Protocols supported by named credentials. Rolling your own authentication is always a recipe for a security problem.

10
  • Thanks , Can you show me an example how to do a POST request and encrypt them in the body of the message? I do not want to hardcode anything.
    – SfdcBat
    Feb 14, 2017 at 18:37
  • I don't believe you can do a POST request with authentication details stored in a Named Credential. You could need to use another method to store the credentials, such as protected custom settings in a managed package. Feb 14, 2017 at 19:51
  • Can you give me the syntax on how I can add the credential in the body of the message. Is this the correct way - developer.salesforce.com/docs/atlas.en-us.apexcode.meta/…
    – SfdcBat
    Feb 14, 2017 at 23:39
  • 2
    @SfdcBat - I believe You are at the mercy of the external system and what it can support. If it is looking for a query parameter and it chokes when not present I am not sure you can pass it any other way. I am probably wrong though...Good read on the security around this: security.stackexchange.com/questions/29598/… AND stackoverflow.com/questions/323200/…
    – Eric
    Feb 15, 2017 at 0:44
  • 1
    @SfdcBat - It all depends on what the external system can accept. If JSON then I guess, if form then it would be like this: stackoverflow.com/questions/14551194/… - "Correct" is defined by the external system which hopefully follows some standard
    – Eric
    Feb 15, 2017 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .