I have a link that gets constructed with an event Id and a user Id (who will also be an event relation for that event). That link gets emailed to that user, where they click it and get brought to a Force.com site with the eventId and userId in the URL at the moment. This is vulnerable to URL hacking. The only real damage someone can do is change different invitees responses to different events if they get their hands on different event/user Ids.

I was finding some information on Session State Protection for visualforce pages, but couldn't find out where exactly those settings were found in a Salesforce org. Is SSP still a thing you can set? If so, that should prevent URL tampering. Everything I found was kind of old and said "Find the VF page, click edit, and go to security section." Which does not exist in any VF page edit link I could find and click on...

If there isn't exactly SSP available for VF pages anymore, do they have some other setting that can prevent URL tampering?


Basically, you need to treat this URL as a password of sorts. The easiest way to do this is to encrypt the parameters.

For example, you could use the following code to generate the URL:

String text = eventId+'/'+userId;
Blob secret = EncodingUtil.base64Decode(Secret__c.get('Secret').Key__c);
String result = EncodingUtil.base64Encode(
    Crypto.encryptWithManagedIV('AES256',' secret, Blob.valueOf(text)));

Where Secret__c is a Custom Setting, and Key__c is a base-64 encoded key generated from Crypto.generateAesKey(256);

Decryption runs in the opposite direction, of course.

Blob secret = EncodingUtil.base64Decode(Secret__c.get('Secret').Key__c);
String result = 
    Crypto.decryptWithManagedIV('AES256',secret, EncodingUtil.base64Decode(textFromUrl))).toString();
String[] parts = result.split('/');
String eventId = parts[0], userId = parts[1];

So, when the user receives the email, they'll get a URL like:


They'll have no way to modify this parameter to "hack" around it, since they need your secret key in order to generate a compatible parameter.

If that's overkill, you could go for a lesser protection: message authentication codes (MAC). That simply involves using a MAC to verify if it's been tampered with, which can look like this:

String text = eventId+'/'+userId;
String mac = EncodingUtil.base64Encode(Crypto.generateMac('hmacSHA256', Blob.valueOf(eventId+'/'+userId), Blob.valueOf('hello world')));

Replace 'hello world' with something more secure, of course. The user would get a URL like this:


You can display an error message if the calculated MAC is missing or does not match the expected value.

  • Thanks for the great answer! That first option with Crypto is most likely what I want to go after. Your info should definitely get sorted out with this encryption :) – Tyler Dahle Aug 3 '17 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.