We have a need for equipment to post status updates to salesforce. Unfortunately the equipment lives on a secure network that will not allow return communication The methods I see all require a request for an auth token and then use that token to post to the rest method. Is there a way to do this in one shot just straight post to the rest method with a preset token or a combo password api token?

  • Pardon me for getting into some networking jargon, but "no return communication" to me says that this secure network wouldn't allow any TCP connections at all (or maybe a firewall is configured to drop all packets from established/related connections or from outside the secure network). Does that describe the situation you're dealing with? Are you able to set up something to sit in between your secure network and the outside world (which would allow you to use the typical OAuth 2.0 flows)? It's possible to do without, but you'd be manually changing out a session id every time it expires.
    – Derek F
    Sep 6 '19 at 16:24
  • They will let the device talk to the internet. So it can post to a url. We currently have it posting to another app use a preset auth token and curl. We want that info to go to Salesforce. However any replies back to the device from beyond the firewall are stopped at the firewall. One way from internal to the internet no response allowed
    – Ohmicron
    Sep 6 '19 at 16:42

Best option - generate your access token outside of your app and keep it alive via another process (see Customer.io: webhook access_token update for details). This will be equivalent to your "preset token" idea. Your app can then use the access token in a one-shot manner.

Another option is to publish your code to force.com and allow unauthenticated access from a platform perspective. You could then read a token of your own format to authorize calls - see the answer in Rest API call to Salesforce from site - one call only , it illustrates this. This is NOT a best practice and it's very risky to implement because of a wide attack surface. Even an amateur attacker working with well-known exploit techniques can achieve quite a bit of success if the implementation doesn't consider a long list of security nuances when rolling something like this.

  • Thanks identigral. I will try these options. We want to have simple json string with a machine identifier and a text comment. This will post to a rest method and that will take the machine identifier and post to it's records chatter feed. Do you think there is a lot of security issues other than erroneous posts to chatter if someone finds it and supplies a proper machine identifier? I can simply deny anything that doesn't look proper in the post
    – Ohmicron
    Sep 6 '19 at 16:46
  • The problem with the mental model of "my code does X and X is harmless" has to do with attacks that redefine X. Whether it's possible to do in your case is a security research question. I wouldn't bet my paycheck on it being impossible.
    – identigral
    Sep 6 '19 at 16:58
  • Thanks again. I hear you loud and clear and will stay away from option 2
    – Ohmicron
    Sep 6 '19 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.