I use Mavensmate, Since morning it is throwing me an error "client identifier invalid" while refreshing or saving any component (Apex Class, Trigger or any) to Salesforce from Sublime.
When I try to Authenticate from Mavensmate, I input username and environment type and click on connect button It throws below error: error=invalid_client_id&error_description=client%20identifier%20invalid
Is there anyone who received the same error, and how to resolve it?
To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce.
MavensMate's codebase has not been updated nor has it been audited for security since development ceased in 2017. Since that time, several of its dependencies have received critical security updates including the open source HTTP client MavensMate uses to transport your code to Salesforce servers – this means the version of MavensMate running on your machine has not received these security updates.
Further, earlier this month, one of MavensMate's contributors found a critical security vulnerability in one of MavensMate.app's dependencies that leaves a user's Salesforce credentials vulnerable to attack. Given the project was sunset in 2017 it was deemed safest to disable the Salesforce Connected App MavensMate used to issue OAuth tokens as well as deliver a final end of life OTA update.
So, once again, please do yourselves a favor and transition to official tooling that is receiving regular updates. This is in your best interest!
-Joe
MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see.
There is the chance it could be brought back to life if you were to supply a connected app client id to the Node process based on an examination of the core MavensMate package. It accepts an environment variable SFDC_OAUTH_CLIENT_ID, and simply uses the now unavailable client id if none is supplied. As Joe explains above, this puts you and all work done using MavensMate at risk of being maliciously exfiltrated due to a critical issue with the application that will not be patched, plus critical issues in dependencies.
The best choice would be to move to more modern tools like SFDX.
mavensmate library is loaded, then patching that to set the variable. OTOH you could probably dig into the various client's node_modules folders and swap out the ID inside it. Even then, there's no guarantee it'd work without extra effort.
Commented
Jul 25, 2019 at 17:31
As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost server. This essentially meant any website you visited could access the auth tokens for your authenticated orgs.
For Example, the following script will return the list of projects authenticated (doesn't get the token, but doing so isn't hard once you have this info)
fetch("http://localhost:56248/execute?command=list-projects", { "credentials": "omit", "headers": { "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" }, "referrer": "http://localhost:56248/app/home", "referrerPolicy": "no-referrer-when-downgrade", "body": null, "method": "GET", "mode": "cors" })
NOTE: I'm only sharing this now because we have officially killed the Client Id and all tokens issued from it.
If you choose to continue using mavensmate (via your own build), then you MUST add CSRF protections and lock down CORS.
However, I'd recommend transitioning to the official salesforce vscode extension. I've put together a short guide on how this can be done with the lowest possible lift (IOW without having to change your file structure).
