5

We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are also being used in Salesforce. This results in exposing queries on browser console. I need to know, how secure is this setup. Since Salesforce query calls are being exposed on browser-console, will the database become accessible with minimal efforts.

1 Answer 1

2

If You are Sending querys with a Salesforce logged user. I think all is Ok.

enter image description here

If You are sending querys with an admin user, You are building an insecure applicattion enter image description here

3
  • Yes, we are sending query through Custom profile's user. How is it going to be secured. I mean by looking into the query, will someone be able to login to database (i.e Salesforce) somehow. Oct 17, 2017 at 7:15
  • I edit the answer with a picture. I hope this clarify you what can be secure and what can be insecure Oct 17, 2017 at 8:03
  • +1 Nice explanation, a picture is better than thousand words. @SalesforceLearner, With queries you need to handle security in apex to avoid SOQL injection, etc. Refer Secure Coding Cross Site Scripting
    – Raul
    Oct 17, 2017 at 8:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .