I have submitted to my app to security review, it resulted me "Password Echo" issue. App consists of a protected custom settings to store the username and password. we have implemented UI to insert/update the user name and password. I have used apex:inputsecret to mask the characters that user inputted. In the inspect element entered value is being displayed. security review is failed resulting the password echo issue.
1
-
Change they way the input behaves. Have it always load a blank value or fake value. Then use it for entry. That may get around the echo issue as the stores password is never shown.– EricCommented Aug 24, 2018 at 7:04
Add a comment
|
2 Answers
Generally SF doesn't allow to store username/password in the system. If you do so it will throw an error as you are getting one.
Check if you can remove it and handle it in some other way that's the best you can do here.
If you are unable to remove it or this is a must-have point then create a document where explain the use case why you need this and why you can't remove it and send that document with your listing. It might help you.
SF also has Security team available for this where you can schedule a call with them. Incall you can explain the use case and they might able to provide you some alternative solution or they accept it and will allow it to clear security review.
answered Aug 23, 2018 at 9:55
It sounds like you're doing the right thing. Here is your checklist:
- use inputSecret tag to enter the password
- use a protected custom setting to store it (this is allowed)
- mark the variable with the transient keyword, so that data is not returned in viewstate (https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_transient.htm)
