1

We are setting up a public Communities page. This page will publish a flow to capture leads but the flow must have read access to Account and another custom object to do its job. Communities requires records be shared with the specific Guest User account in order for the Flow to have access to those records and now fail due to lack of access.

My question is if the records are shared via Sharing Rules with the Guest user, can calls be made to the Salesforce API in any way to access this shared data without a Salesforce username and password or other method of user authentication?

Are there any other security risks I may be overlooking?

2

1 Answer 1

1

My question is if the records are shared via Sharing Rules with the Guest user, can calls be made to the Salesforce API in any way to access this shared data without a Salesforce username and password or other method of user authentication?

I wouldn't consider it a risk unless you explicitly give API access to the guest profile.

If you look at your guest profile the following Administrative Permissions are not enabled (by default):

  1. Apex Rest Services (Your custom services in apex)
  2. API Enabled (Salesforce-provided APIs)

enter image description here

Even if we're talking about any profile, if #2 is not selected then they will not be able to make API calls with their access/username (which is required to make calls). In the context of guest users, this generally means the risk of what you're asking about should be handled by Salesforce's permissioning as they don't have access to the API at all.

Now, if you give those permissions to the guest profile - you should re-consider the above as that changes the conversation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.