We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp to embed the external web platform directly into Salesforce.
Our security review failed because we didn't follow
Insecure Storage of Sensitive Data security measures on the
consumerKey of the Connected App.
The connected app XML had the
consumerKey in it (where "WholeLongExposedConsumerKey" had the actual key):
<?xml version="1.0" encoding="UTF-8"?> <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata"> <contactEmail>email@example.com</contactEmail> <description>test</description> <developerName>namespace__ConnectedApp1</developerName> <hasMobileDeviceProtection>false</hasMobileDeviceProtection> <iconUrl>https://link/to/icon.png</iconUrl> <label>Connected App 1</label> <logoUrl>https://link/to/icon.png</logoUrl> <oauthConfig> <callbackUrl>http://localhost:3000/auth/salesforce/callback?scope=api%20full%20id%20refresh_token</callbackUrl> <consumerKey>WholeLongExposedConsumerKey</consumerKey> <isAdminApproved>false</isAdminApproved> <scopes>Basic</scopes> <scopes>Api</scopes> <scopes>Full</scopes> <scopes>RefreshToken</scopes> </oauthConfig> <version>1.0</version> </ConnectedApp>
...and they noted:
In both ConnectedApp1 and ConnectedApp2, the consumerKey is stored insecurely
As far as I know, you can't hide the
consumerKeyfrom the connected app metadata, nor can you change it (i.e. try encrypting it, etc) as it is read-only. Could this be a potential false positive? Our connected app settings demand the external platform to also provide the secret key, which is not exposed at all.
If it's not a false-positive, how would I securely store this
consumerKeyconsidering that I have no control over it?
Do I have to come onto a whole different authentication approach just to have this pass the security review?
I'm hoping (3) isn't the only option, as we already have a stable working package as is.