1

I created a Rest service to insert/update contacts & opportunities from a donation page on my client's site. The web developer refuses to make more than one call from the script that posts to my REST class.

Both OAuth & Username/Password authentication require 2 calls (potentially) OAuth - once I've got the initial refresh token, it requires a new token every time the old token expires, & Username/Password requires a new token on each call. I really don't want to use the Username/Password flow in any case as it is insecure.

Does anyone have any ideas here?

|improve this question
2

There's going to be at least two calls involved unless you use webhook-style authentication on a Apex REST API endpoint exposed to the public through a Force.com Site. With that style of authentication, you accept input from any caller in an unauthenticated session, and authenticate it through an HMAC with a pre-shared secret key. The running user for your Apex is the site guest user, rather than some integration or system user.

You lose some control here. You don't have a Connected App. You can't track inbound logins that way. Anybody on the Internet can poke your API - you have to code very, very defensively. I'm not an infosec expert but there's definitely implications to think through (how about a replay attack, for example?)

No matter which OAuth flow you use, or even if you decided to use a SOAP login() call to get a Session Id, you'll have at some point to make a call to obtain a the session id (one call), plus making the actual call to your REST endpoint (two calls).

Personally, I would treat this more as a communication problem than a technical one. The web developer's intransigence doesn't really make sense to me on the face of it, and is going to push you to use a less-optimal architecture for, potentially, no good reason. I'd talk it through and find out why.

|improve this answer
  • Thanks for the feedback. I agree about the web developer :) – hgolov Jun 11 at 19:28
0

If exposing an unauthenticated endpoint for your service would be appropriate, you can do that using Force.com Sites or Communities.

|improve this answer
  • You mean similarly to how we would have a public facing form on a Force.com site without authentication? How would I implement? – hgolov Jun 11 at 19:25
  • Yes, in the site's public access settings, set the apex class containing the web service to "Enabled". – Daniel Zeidler Jun 11 at 19:32
  • That sounds super dangerous. Start with the potential for injection of false and malicious data by literally anyone, and go up from there depending on what the return values from the web service look like. – David Reed♦ Jun 11 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.