1

I am referring a document from salesforce help at https://help.salesforce.com/articleView?id=users_login_history.htm&type=5 which reads below-

View the HTTP method used for the session login: POST, GET, or Unknown. You can use this information to determine if a user is inadvertently exposing user credentials through a GET request. For example, if a user entered a username and password on the login page, the HTTP method for login is a secure POST request. However, if the user logged in by providing the username and password in the URL as a GET request, the credentials are exposed. From Setup, enter Login History in the Quick Find box, then select Login History and view the HTTP Method column.

  1. Are we allowed to login to salesforce using REST Get? I don't find any Get approach, only thing I could find is Post. If such method exist then can any one provide documentation link or any further information.
  2. Even if such a get method exist then (and I missed it to find) then why salesforce has such thing at very first place. Isn't it like designing a trap and then monitor who all fall into that trap?

1 Answer 1

1

Are we allowed to login to salesforce using REST Get? I don't find any Get approach, only thing I could find is Post. If such method exist then can any one provide documentation link or any further information.

Yes, you can login with the following URL pattern:

https://login.salesforce.com/?un=encoded-username%40domain.tld&pw=ExposedPassword

I don't believe this is in the documentation, and certainly people should avoid using this in favor of actual secure login methods, such as the Lightning Authenticator, etc.

Even if such a get method exist then (and I missed it to find) then why salesforce has such thing at very first place. Isn't it like designing a trap and then monitor who all fall into that trap?

Actually, the trap was set by either HTTP or HTML, take your pick. The form tag allows two methods, "GET" and "POST." In order to be compliant with the standards, HTTP allows query strings and application/x-www-form-url-encoded. Salesforce is simply complying with the standards. This is all ancient history, but as with most web technology, we are burdened by the mistakes of the 80s and 90s, that we can't just remove because it could break untold number of services, apps, etc.

By monitoring the situation, administrators can tell their users to change their behaviors. This is the best that can be reasonably expected given the historical context.

5
  • I tried hitting "login.salesforce.com/?un=encoded-love%40test.com&pw=qwerty" and it routed me to login screen (if I login using [email protected] and qwerty is my password). Am I missing something? I also tried appending security token with password that didn't work either.
    – love gupta
    Commented Apr 26, 2020 at 0:36
  • @lovegupta Is this for a production org? If not, needs to be test.salesforce.com or whatever. It does work, I tested this out using my own login before I posted this answer.
    – sfdcfox
    Commented Apr 26, 2020 at 0:40
  • It is a development edition org and I just enter my email id [email protected] as user name to login to that org. Do we need to append security token to the password here (I do that when I use Post to get the oauth token).
    – love gupta
    Commented Apr 26, 2020 at 0:59
  • @lovegupta No, the Security Token is for API logins. Check your user's Login History, it should show you if there was a problem (assuming the username is correct).
    – sfdcfox
    Commented Apr 26, 2020 at 1:15
  • finally it worked for me. I removed "encoded-" before love. "login.salesforce.com/?un=love%40test.com&pw=qwerty" lets me login if my login id at login.salesforce.com UI is "[email protected]" and password is "qwerty". I can also see my login in the login history as a Get login. Thanks a lot @sfdcfox
    – love gupta
    Commented Apr 26, 2020 at 1:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .