In my current implementation of an Apex REST callout code to external system , I have to set an endpoint using a Named credentials-NAMED_CRED. The Named Credential has an endpoint like -


I use req.setEndpoint('callout:NAMED_CRED') in my code while making a Callout. This approach is showing up in security analysis that it is not safe to send the userid and password in URL. Is there any other way I can set the credential details with out hardcoding the credentials in the COde. One of the good practice I want to follow is not to change the code when credential detail changes or endpoint has to be changed. Is there way to do this?

The code using POST:

public class jsonWrapper {
        public String userID {get; set;}
        public String Password {get; set;}

jsonWrapper wrap = new jsonWrapper();
wrap.userID = 'YYYY';
wrap.Password = 'xxx';
String jsonBody = json.serialize(wrap);
system.debug('JSON Body****' + jsonBody);

HttpRequest req = new HttpRequest(); 
HTTP auth = new HTTP();
HTTPRequest r = new HTTPRequest();

HTTPResponse authresp=new HttpResponse();
authresp = auth.send(r); 

Output I get :

17:18:04:002 USER_DEBUG [10]|DEBUG|JSON Body****{"userID":"SA-ITS-SFDCRESTUser","Password":"Ez4u2Get"}
17:18:05:446 USER_DEBUG [22]|DEBUG|{"statusCode":"1160","severity":"FATAL","statusMessage":"Required String parameter 'userID' is not present"}
17:18:05:446 USER_DEBUG [23]|DEBUG|System.HttpResponse[Status=OK, StatusCode=200]

Passing the credentials in the query string isn't safe. Any system that can see the request coming through can read the values straight of the request. Rather, switch to a POST request and encrypt them in the body of the message.

Better yet, switch to one of the Authentication Protocols supported by named credentials. Rolling your own authentication is always a recipe for a security problem.

  • Thanks , Can you show me an example how to do a POST request and encrypt them in the body of the message? I do not want to hardcode anything.
    – SfdcBat
    Feb 14 '17 at 18:37
  • I don't believe you can do a POST request with authentication details stored in a Named Credential. You could need to use another method to store the credentials, such as protected custom settings in a managed package. Feb 14 '17 at 19:51
  • Can you give me the syntax on how I can add the credential in the body of the message. Is this the correct way - developer.salesforce.com/docs/atlas.en-us.apexcode.meta/…
    – SfdcBat
    Feb 14 '17 at 23:39
  • 2
    @SfdcBat - I believe You are at the mercy of the external system and what it can support. If it is looking for a query parameter and it chokes when not present I am not sure you can pass it any other way. I am probably wrong though...Good read on the security around this: security.stackexchange.com/questions/29598/… AND stackoverflow.com/questions/323200/…
    – Eric
    Feb 15 '17 at 0:44
  • 1
    @SfdcBat - It all depends on what the external system can accept. If JSON then I guess, if form then it would be like this: stackoverflow.com/questions/14551194/… - "Correct" is defined by the external system which hopefully follows some standard
    – Eric
    Feb 15 '17 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.