6

My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for a protected custom setting, I've created a post-installation class that manually sets the custom setting value via code.

The problem is, our security review results suggest that the key should not be stored in code in plain text. How can I go about setting the protected custom setting value if not from code? I'd rather not have the user do this manually.

|improve this question
  • 1
    Could you get away with a default value and then just create a new setting with your install script? – greenstork Jun 2 '14 at 20:09
  • 1
    The scanner may be wrong; direct attempts to get at the protected setting should fail (e.g. checking debug logs, accidentally storing the value directly in a visualforce page (but not if copied to another variable, etc). As such, I'd expect that you would simply want to ask the review board directly. Failing that, you could encrypt/decrypt on each use, but I'd suspect that if you can't trust the built-in protection, doing this won't provide any extra security. – sfdcfox Jun 2 '14 at 20:15
  • sfdcfox - This was actually feedback given to us from a member of the review team, not the scanner itself. I thought about encrypt/decrypt, but you would need a key, correct? Which brings us back to the problem of where to store it. – emroc Jun 2 '14 at 20:24
  • greenstork - Interesting idea - I may explore that. I didn't think you could create an empty custom setting, but I don't see why it wouldn't be possible. – emroc Jun 2 '14 at 20:25
  • 1
    It wouldn't be empty, it would get your default field values. – greenstork Jun 2 '14 at 20:45
1

You could as an alternative to setting the custom setting with code create a default value for your protected custom setting fields and then just instantiate and create the setting with your install script.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.