0

I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code.

 Blob headerValue = Blob.valueOf(username + ':' + password);
        String authorizationHeader = 'Basic ' + EncodingUtil.base64Encode(headerValue);
        system.debug('Encoder Value' + EncodingUtil.base64Encode(headerValue));
        http http = new http();
        httpRequest request = new httpRequest();
        request.setMethod('POST');
        request.setEndpoint(endpoint);
        request.setHeader('Content-Type', 'application/x-www-form-urlencoded');
        request.setHeader('Authorization', authorizationHeader);

There is no hard Coded value in My code, username and password is the input parameter for this method.

request.setHeader('Authorization', authorizationHeader); --> In Apex PMD report, Secutiry issue showing in this line.

Gone through this link, still can't able to find the cause. https://pmd.github.io/latest/pmd_rules_apex_security.html#apexsuggestusingnamedcred

1
  • 1
    Yes, it's likely because it looks at the String Authorization and is detecting that you might have hard coded credentials there.
    – manjit5190
    Aug 9, 2020 at 13:51

2 Answers 2

1

This is more of a suggestion than a hard rule. There are obviously times when you need to use direct authorization for some reason. This rule suggests that you should use Named Credentials when possible, because it is inherently more secure. If your use case warrants it, you can suppress this warning via @SuppressWarnings.

1
  • 1
    or the // NOPMD comment on the relevant line
    – cropredy
    Aug 10, 2020 at 18:29
0

look out to this reference: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm

HttpRequest req = new HttpRequest();
req.setEndpoint('callout:My_Named_Credential/some_path');
req.setMethod('GET');
Http http = new Http();
HTTPResponse res = http.send(req);
System.debug(res.getBody());

I guess the pmd marks it as an error because you shouldn't set the header directly in the code, so even if there is no plain password in the string it marks this line as a warning.

as sfdcfox already mention you can ignore this warning or try to solve it with named_credentials (if it is possible)

Greets, Bernhard

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.