0

Is it possible to create custom lightning component on a Customer community that can talk to each other to load data without using the standard Salsforce URL structure?

I think it's quite a huge security risk to show the ID in the URL for a customer community which enables a user to data-mine using simple scripts.

How can I get one component on my home page: community.org/c/s/ to talk to a component on another page community.org/c/my-data Is this even possible?

Without having a salesforce id such as: community.org/c/s/detail/0030000000002Weas2

I just need to pass the recordId of what was loaded on the home page, to pass through a button push to the my-data page and be loaded in a component there.

Improve this question
5
  • 2
    Exposing a Salesforce ID is hardly a security risk. You can't just type in any ID you want and get the record back. Your user account must have access to the record, and ID values are not issued sequentially in an org, either (not necessarily, anyways). The only thing you're really exposing by using a Salesforce ID is the fact that you're using Salesforce.
    – sfdcfox
    Nov 1, 2018 at 1:57
  • It is a risk. If a customer has access to contacts, which is necessary, even though the ids are “non-sequential”, a hacker could right an easy script and test the URL for any data and then mine away.
    – DCole
    Nov 1, 2018 at 3:10
  • not if your security settings are correct. The error shown for a record you can't see and one that doesn't exist is the same.
    – sfdcfox
    Nov 1, 2018 at 3:22
  • If a customer has read/write access on a contact, wouldn’t they also have RW access on other contacts, even in a different account?
    – DCole
    Nov 1, 2018 at 5:29
  • No, that's not how Salesforce, or Communities, work.
    – sfdcfox
    Nov 1, 2018 at 11:46

1 Answer 1

Reset to default
1

I think it's quite a huge security risk to show the ID in the URL for a customer community which enables a user to data-mine using simple scripts.

Not necessarily. Record Ids are almost integral part of any Salesforce URL, so that really does not possess any risk and can be used. Anyone will be able to get data out of that if and only if they have necessary access OR they are really good hackers!

I just need to pass the recordId of what was loaded on the home page, to pass through a button push to the my-data page and be loaded in a component there.

You need an application event here.

Application events follow a traditional publish-subscribe model. An application event is fired from an instance of a component. All components that provide a handler for the event are notified.

You will just need to fire the event from the component on the home page on click of the button and handle the event on the other page.

For more details around events, you can refer to the documentation.

Improve this answer
2
  • Thank you for this! I’ll give it a go. Hopefully it’s not too difficult.
    – DCole
    Nov 2, 2018 at 4:36
  • It's not difficult. There's lot of documentation/resources available on using application events, so you will get good examples of how to implement it.
    – Jayant Das
    Nov 2, 2018 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.