1

I would like to have the profiles of the Users in my organization to be displayed on a public-accessible website.

According to the developerforce documentation, it seems as though this requires an oauth access_token in order to access these pictures, which is less than desirable since it could be ripped out of the resultant HTML.

Amazon s3 has always stood out to me as the canonical place to host assets, and since Salesforce has an Amazon Toolkit available, I thought I'd try to see if I could find an open-source / app-exchange utility that could do the following:

  • Store a Salesforce User's profile picture in S3 as a publicly readable asset.
  • Store the resulting Amazon S3 asset URL in a custom attribute on the User object.
  • Retain the functionality of native salesforce file operations, like displaying the profile picture in default visual force views, etc.

Does anyone know of a utility that could help me provide the features listed above? Is this currently only possible by writing additional APEX code?

Thanks in advance!

1 Answer 1

1

I'm not sure that OAuth is less-desirable than something else, especially since it is pretty much the security method of choice. If you're passing the token in HTML (and I'm not sure how that would be done) then maybe you're doing something wrong?

I think that your best option is, indeed, to set up something to authenticate into Salesforce for the images. OAuth is a good method.

2
  • To my understanding, I need to append my oauth token to the url of the image hosted on salesforce in order for it to be rendered as expected. Displaying this in my markup is not desirable because I am effectively giving away my OAuth token to anyone with developer tools in their browser, which is everyone. Are you suggesting that there is an alternative way to do this? Could you please augment your answer with an example? I can't find much in the documentation that would suggest otherwise.
    – kelly.dunn
    Apr 15, 2014 at 16:47
  • I don't know enough to teach you how to use OAuth, but your question as asked wants to know if you should make a complicated setup to put your photos on S3. The answer is that no, you should not, and furthermore, you should be using OAuth. Perhaps you could ask in a separate question how to do that. Or could read the extensive OAuth/security documentation at developer.force.com. Apr 15, 2014 at 23:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .