12

I use Mavensmate, Since morning it is throwing me an error "client identifier invalid" while refreshing or saving any component (Apex Class, Trigger or any) to Salesforce from Sublime.

enter image description here

When I try to Authenticate from Mavensmate, I input username and environment type and click on connect button It throws below error: error=invalid_client_id&error_description=client%20identifier%20invalid

enter image description here

Is there anyone who received the same error, and how to resolve it?

  • 3
    You may need to set proxy if you are under corporate firewall. Mavensmate is great but there is no longer development going on for the project, maybe its time to switch to VScode which has all the latest features. Also kindly verify if you are using correct credentials with security token? – Raul Jul 24 at 12:42
  • Thanks @Raul , I've checked it on my personal network, Still It didn't work. It seems I'll have to switch to some other tool (unfortunately). – RKM Jul 25 at 7:22
26

To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce.

MavensMate's codebase has not been updated nor has it been audited for security since development ceased in 2017. Since that time, several of its dependencies have received critical security updates including the open source HTTP client MavensMate uses to transport your code to Salesforce servers – this means the version of MavensMate running on your machine has not received these security updates.

Further, earlier this month, one of MavensMate's contributors found a critical security vulnerability in one of MavensMate.app's dependencies that leaves a user's Salesforce credentials vulnerable to attack. Given the project was sunset in 2017 it was deemed safest to disable the Salesforce Connected App MavensMate used to issue OAuth tokens as well as deliver a final end of life OTA update.

So, once again, please do yourselves a favor and transition to official tooling that is receiving regular updates. This is in your best interest!

-Joe

  • 4
    Thanks Joe, hopefully your statement will get everyone to transition and stop trying to jury-rig the app. It's a fun exercise to dig in and make it work, but I also listened to the announcement in 2017 and made the switch then. – gelliott181 Jul 26 at 19:38
  • 1
    Totally agree. I think most of us have already transitioned to the official tooling but there are some old lingering projects. Going to delete the fix – CodeNinja Jul 27 at 12:38
  • As we see that MavensMate has become obsolete and not getting any update, So I moved to VS Code now. – RKM Jul 30 at 12:21
9

MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see.

There is the chance it could be brought back to life if you were to supply a connected app client id to the Node process based on an examination of the core MavensMate package. It accepts an environment variable SFDC_OAUTH_CLIENT_ID, and simply uses the now unavailable client id if none is supplied. As Joe explains above, this puts you and all work done using MavensMate at risk of being maliciously exfiltrated due to a critical issue with the application that will not be patched, plus critical issues in dependencies.

The best choice would be to move to more modern tools like SFDX.

  • 1
    Thanks! I believe there is only option left now, switch to some other tool (VS Code). – RKM Jul 25 at 7:28
  • 1
    @HSG There are tons of resources available on how to work with node process variables. The hard part will be finding how the mavensmate library is loaded, then patching that to set the variable. OTOH you could probably dig into the various client's node_modules folders and swap out the ID inside it. Even then, there's no guarantee it'd work without extra effort. – gelliott181 Jul 25 at 17:31
  • The real answer would have been to get more devs contributing and not leave the onus on the repo owner to maintain it. That may have kept it alive longer. – gelliott181 Jul 25 at 17:33
  • @HSG great! Please share the steps for the same once you make it work. thanks! – RKM Jul 25 at 18:01
  • This is sad news ... truly soul crushing (even though we knew it was inevitable). :( – Chris Emerson Aug 6 at 15:48
7

As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost server. This essentially meant any website you visited could access the auth tokens for your authenticated orgs.

For Example, the following script will return the list of projects authenticated (doesn't get the token, but doing so isn't hard once you have this info)

fetch("http://localhost:56248/execute?command=list-projects", { "credentials": "omit", "headers": { "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" }, "referrer": "http://localhost:56248/app/home", "referrerPolicy": "no-referrer-when-downgrade", "body": null, "method": "GET", "mode": "cors" })

NOTE: I'm only sharing this now because we have officially killed the Client Id and all tokens issued from it.

If you choose to continue using mavensmate (via your own build), then you MUST add CSRF protections and lock down CORS.

However, I'd recommend transitioning to the official salesforce vscode extension. I've put together a short guide on how this can be done with the lowest possible lift (IOW without having to change your file structure).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.