We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are also being used in Salesforce. This results in exposing queries on browser console. I need to know, how secure is this setup. Since Salesforce query calls are being exposed on browser-console, will the database become accessible with minimal efforts.
asked Oct 16, 2017 at 7:33
Add a comment
|
1 Answer
If You are Sending querys with a Salesforce logged user. I think all is Ok.
If You are sending querys with an admin user, You are building an insecure applicattion
-
Yes, we are sending query through Custom profile's user. How is it going to be secured. I mean by looking into the query, will someone be able to login to database (i.e Salesforce) somehow. Oct 17, 2017 at 7:15
-
I edit the answer with a picture. I hope this clarify you what can be secure and what can be insecure Oct 17, 2017 at 8:03
-
+1 Nice explanation, a picture is better than thousand words. @SalesforceLearner, With queries you need to handle security in apex to avoid SOQL injection, etc. Refer Secure Coding Cross Site Scripting– RaulOct 17, 2017 at 8:09