We currently have an integration with our external platform inside salesforce by using IFrames. For authentication we pass the Salesforce session as a query string parameter inside the IFrame address and do callback authentication from our external platform. But our client now feels this mode is insecure as we pass salesforce session id in plaintext.

Can we improve this by anyway? I also feel this is a old way of doing integration. Are there any better methods available now?

  • your client is correct - it's insecure. Can you get away from the iframes? what are your requirements?
    – Saariko
    Oct 31 '12 at 6:48
  • @Saariko Our requirement is to show a report at every salesforce Account Page. The data for that report comes from our external platform.
    – tamizhgeek
    Oct 31 '12 at 6:51
  • Eventhough the endpoint is https, the client felt that the session_id could get logged in the server logs; as it was passed in query params. So instead of doing authentication with Salesforce session_id - we have now implemented a SAML auth.
    – tamizhgeek
    Jul 12 '13 at 6:35

If the iframe address is https, then the session id is secure on the wire. You could encrypt it as well, with a shared secret, but I'm not sure how much practical advantage that would give, since the browser can see the session id in the cookie anyway.

There is a new approach to this kind of integration - Force.com Canvas - but it is (as of Winter '13) still in pilot.

  • Oh Thanks! Our endpoint it https only. Can you give me more pointers on encrypting ourselves?
    – tamizhgeek
    Oct 31 '12 at 6:52
  • Like I said, I don't think you gain anything by adding another layer of encryption, but you could use the Apex Crypto class to AES encrypt the token with a shared secret.
    – metadaddy
    Oct 31 '12 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.