-1

I want to call a non salesforce API from an LWC UI. I want the request from the browser to the API to be secured (authenticated at the very least and ideally authorised).

From what I've read, I believe I should create an endpoint with SalesForce Apex to create a proxy onto my API. Secure the Apex proxy call with an API key (for example) or OAuth client credentials flow.

The I can secure the browser call to the Apex endpoint by ensuring the LWC code can pass the user/agents bearer token.

Can I check the validity of the bearer token passed by the browser in Apex code? Or is there a different mechanism?

Instead is there a best practice approach I can use secure the request? Best practice docs seem very light on the ground!

Improve this question
3
  • There's an overhead in having this callout done from the Salesforce org, but doing it here rather than in the browser, is far more secure. The user doesn't even see that another system is being called (which they could discover if you did this in JavaScript within their browser). They have no access to any token for that system either. Additionally, using the server to do it allows you to whitelist the server as able to call that external service on the external service end too, again increasing security.
    – Phil W
    Mar 17 at 16:58
  • This still seems very weak?
    – iasksillyquestions
    Mar 17 at 17:00
  • No. You use named credentials or similar to provide the integration. There's plenty of documentation about this sort of integration in the Salesforce docs and on trailhead.
    – Phil W
    Mar 17 at 17:01

1 Answer 1

Reset to default
0

You should never directly call other authenticated systems from the browser. That should always be done via Apex. LWC -> Apex -> other system -> Apex -> LWC

For authentication/authorization, you should ideally be using Named Credentials which can handle the refresh / access tokens for you if you're doing OAuth and deals with other mechanisms as well. https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm&type=5

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .