I'm preparing for my first security review for an application which has an external web app.

I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. This is because my web app has static files hosted on AWS S3.

An example <script type="text/javascript" src="https://my_app.s3.amazonaws.com/js/js.js"></script>

The report states that the risk level is low, is the something I need to resolve or something that can be explained away as I go through the review?

  • Why is the script on AWS and not inside SFDC ? – Mohith Shrivastava Aug 3 '17 at 17:07
  • I'm doing data aggregation outside of SFDC, therefore I need an application hosted elsewhere. This app may need to integrate with another CRM so hosting externally was the way to go – shartshooter Aug 3 '17 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.