1

While working on a custom visualforce community, we noticed the guest site user login attempt is being captured. We were expecting a cookie (https://releasenotes.docs.salesforce.com/en-us/winter17/release-notes/code_add_users_debug_log.htm) to be necessary for the logs to be generated which solves our security issue. Does anyone know if this will happen also in production?

0

1 Answer 1

2

This change was reversed in spring '18, quoting from release note documentation: Collect Debug Logs for Guest Users Without Setting Cookies

Sadly, people didn’t like the Winter ’17 change. Setting cookies is complicated, and the change made collecting debug logs for public users’ asynchronous activity impossible. We’ve seen the error of our ways. Your public users no longer need a debug_logs browser cookie to trigger logging.

This feature would be available if your production is upgraded to spring '18.

1
  • Thank you very much for the feedback !! This is a security concern because anybody that can see debug logs can see usernames and passwords from login community forms (exposed through variable assignment messages) Commented Apr 9, 2018 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .