5

We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are also being used in Salesforce. This results in exposing queries on browser console. I need to know, how secure is this setup. Since Salesforce query calls are being exposed on browser-console, will the database become accessible with minimal efforts.

2

If You are Sending querys with a Salesforce logged user. I think all is Ok.

enter image description here

If You are sending querys with an admin user, You are building an insecure applicattion enter image description here

  • Yes, we are sending query through Custom profile's user. How is it going to be secured. I mean by looking into the query, will someone be able to login to database (i.e Salesforce) somehow. – Salesforce Learner Oct 17 '17 at 7:15
  • I edit the answer with a picture. I hope this clarify you what can be secure and what can be insecure – Edu Trujillo Oct 17 '17 at 8:03
  • +1 Nice explanation, a picture is better than thousand words. @SalesforceLearner, With queries you need to handle security in apex to avoid SOQL injection, etc. Refer Secure Coding Cross Site Scripting – Raul Oct 17 '17 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.