I want to use the Bee Template API inside my Visualforce page. So, this is the code I used:

    //Visualforce Page
    <apex:page showHeader="false"
    <apex:form >
        <apex:pageBlock rendered="true"> 
            <div id="bee-plugin-container" style="overflow:auto; padding:5px;">

    <apex:includeScript value="https://app-rsrc.getbee.io/plugin/BeePlugin.js"/>
    <apex:includeScript value="https://johnresig.com/files/htmlparser.js"/>

    <script type="text/javascript">

    //Rest of the code

        function (token) {
          BeePlugin.create(token, beeConfig, function (beePluginInstance) {
            bee = beePluginInstance;
              function (template) {

    <!--Rest of the code-->


This is the code to initialize the Bee Template API. The value of clientId and clientSecret are stored as Custom Metadata Types and are retrieved in the controller apex class:

//visualforce controller apex class
global with sharing class TemplateMakerClass {
    public String clientId {get;set;}
    public String clientSecret {get;set;}
    public TemplateMakerClass() {
        clientId = PropertiesClass.getBeeClientId();
        clientSecret = PropertiesClass.getBeeClientSecret();

    //Rest of the code

In the PropertiesClass, metadata types are retrieved using SOQL queries. The code works fine. But, the problem I am facing is that, as clientId and clientSecret are used in the JavaScript code, it is exposed in the browser, ie, I can see values of both variables in the page source. Its showing a Information Disclosure Vulnerability issue when I submit app for security review because of this. So, how can I solve this? Is there any way to use the variables inside the JavaScript without exposing to browser?

  • 2
    You need to move the HTTP interactions into an action function in the controller since it is only by doing this in the server-side that you can protect these values.
    – Phil W
    Oct 2 '20 at 13:58
  • Unrelated to your question, but I would be careful with the htmlparser.js you're importing. It only supports HTML 4.01 so it will have trouble with HTML 5.
    – nbrown
    Oct 2 '20 at 16:18

Is there any way to use the variables inside the JavaScript without exposing to browser?

No, you cannot secure JavaScript against attacks from the client.

All processing of secrets and authorization using credentials to which the end user is not privy must be done on the server side using Apex. As a managed package, you should ensure that those values are shipped in Protected Custom Metadata, do the authentication server-side, and only provide client-side functionality with values that are user-safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.