2

We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp to embed the external web platform directly into Salesforce.

Our security review failed because we didn't follow Insecure Storage of Sensitive Data security measures on the consumerKey of the Connected App.

The connected app XML had the consumerKey in it (where "WholeLongExposedConsumerKey" had the actual key):

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <contactEmail>[email protected]</contactEmail>
    <description>test</description>
    <developerName>namespace__ConnectedApp1</developerName>
    <hasMobileDeviceProtection>false</hasMobileDeviceProtection>
    <iconUrl>https://link/to/icon.png</iconUrl>
    <label>Connected App 1</label>
    <logoUrl>https://link/to/icon.png</logoUrl>
    <oauthConfig>
        <callbackUrl>http://localhost:3000/auth/salesforce/callback?scope=api%20full%20id%20refresh_token</callbackUrl>
        <consumerKey>WholeLongExposedConsumerKey</consumerKey>
        <isAdminApproved>false</isAdminApproved>
        <scopes>Basic</scopes>
        <scopes>Api</scopes>
        <scopes>Full</scopes>
        <scopes>RefreshToken</scopes>
    </oauthConfig>
    <version>1.0</version>
</ConnectedApp>

...and they noted:

In both ConnectedApp1 and ConnectedApp2, the consumerKey is stored insecurely

Questions:

  1. As far as I know, you can't hide the consumerKey from the connected app metadata, nor can you change it (i.e. try encrypting it, etc) as it is read-only. Could this be a potential false positive? Our connected app settings demand the external platform to also provide the secret key, which is not exposed at all.

  2. If it's not a false-positive, how would I securely store this consumerKey considering that I have no control over it?

  3. Do I have to come onto a whole different authentication approach just to have this pass the security review?

I'm hoping (3) isn't the only option, as we already have a stable working package as is.

Improve this question

2 Answers 2

Reset to default
1

We use Connected Apps as you describe them, but we don't actually include them in the package (they don't need to be included for a customer to be able to utilize them in my experience) and our apps passed without issue. So that might be an option - just remove them from the actual package.

But it also sounds like a false positive, because the Consumer Key isn't considered sensitive in my experience - we use it in URLs for oauth flows. so I would also suggest scheduling Office Hours with the SR team to see what they suggest, or try posting in the Security Review group in the Partner Community

Improve this answer
1
  • Thanks! For our Canvas App, I doubt we'd be able to leave that out of the package, since it's core to the whole package. I'll post on the Security Review group and see what they say
    – Brian Miller
    Commented Aug 14, 2019 at 16:05
1

The Security Review team got back to us. The consumerKey that's being stored in the Connected App metadata is a false-positive and they disregarded it in the re-submission.

It's worthwhile to just document that you're aware of the exposed consumerKey and that it's not sensitive data that needs to be hidden.

Improve this answer
1
  • 1
    Be sure to mark this as the answer!
    – Mark Pond
    Commented Aug 28, 2019 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .