We have done the code review by salesforce,and got "Avoid Using Hard Coded Credentials for Authentication" at quite some places where ever we are setting up Authorization Header.(On the 5th line of following code).

    String access_Token=getAccessToken();
    http h =new http();
    HttpRequest req=new HttpRequest();
    req.setHeader('Authorization', access_Token);

getAccessToken Method

    Http h = new Http();
        HttpRequest req = new HttpRequest();
        HTTPResponse res; 

        List<String> urlParams = new List<String> {
                'client_id=' + EncodingUtil.urlEncode(client_id, 'UTF-8'),
                'resource=' + EncodingUtil.urlEncode(resource_URI, 'UTF-8'),
                'username=' + EncodingUtil.urlEncode(username, 'UTF-8'),    
                'password=' + EncodingUtil.urlEncode(password, 'UTF-8'),
                'scope=' + EncodingUtil.urlEncode(scope, 'UTF-8')
        req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
        req.setHeader('Accept', 'application/json');
        String body = String.join(urlParams, '&');
        res = h.send(req);

As we are not hard coding access token here, Fetching Client_Id, UserName & password from Custom Settings. we are doing oAuth 2.0 callout to fetch access token. and we are setting up the Autharization Header with returned access token + Token Type(Bearer).

So my question is we have n't done the hard coding here, so what might be the reason to get this error?

  • 2
    Can you edit your post and add more code? And also: are you using Named Credentials? – Bartosz Śliwiński Jun 26 at 13:27
  • @BartoszŚliwiński added the getAccessToken method code. we are not using named credentials here as we are integrating with MS_Dynamics – Narendra Nimmana Jun 26 at 13:36
  • You are still missing too much context in the above to be able to conclusively determine what Salesforce might have even flagged. – Adrian Larson Jun 26 at 13:41
  • I would say that storing Password in Custom settings (CS is accessible to anyone who has API access) is the issue here. I have never integrated with MS_Dynamics. Can you say why Named Credentials usage is impossible in your case? – Bartosz Śliwiński Jun 26 at 13:42
  • @BartoszŚliwiński, Named credentials does n't seems to work with MS Dynamics, I can create an Auth. provider of type Microsoft Access Control Service can use same in Named Credentials.But we can't set up certain parameters like "resource". Also i need to mention getAccessToken method is in separate class,I agree Storing Password in CS might cause an issue, if that is the case issue should be on that particular class. But we are getting where ever we use the method – Narendra Nimmana Jun 26 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.