We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ".

I am making a call to external service to get a encrypted claim that i am using to login into a iframe.

We are not storing any sensitive information in salesforce. Only place where we are storing this encrypted claim is in js variable.

Is this false positive or i am missing something here.

Here is HTML code

<form id="helperForm" target="name" method="post" action= {hostUrlLogin}>
                    <input id="targetUrl" type="hidden" name="targetUrl" value={targetUrl}/>
                    <input id="ssoProvider" type="hidden" name="ssoProvider" value={ssoProvider}/>
                    <input id="encryptedClaims" type="hidden" name="encryptedClaims" value={encryptedClaim}/>

Js code

                customDashboard : this.dashboardId,
                recordId: this.recordId
        ]).then(data => {
            if(data[0] && data[1]){
                this.encryptedClaim = data[1];
                this.targetUrl = data[0].url;
                this.iframeHeight = data[0].dashboardHeight;
                this.hostUrlLogin = data[0].hostUrl + 'xxxxx';
                // some logic to show dashboard.
            } else if(!data[0]){
                this.analyticsSetingPresent = false;

and apex code

public static string getPGPKey(){
    try {
        Http http = new Http();
        HttpRequest request = new HttpRequest();
        request.setHeader('x-api-key', 'xxxxxx');
        request.setHeader('content-type', 'application/json');
        Long plusOneDate = DateTime.now().addDays(1).getTime() / 1000;
        Long nowTime = DateTime.now().getTime() / 1000;
        JSONGenerator gen = JSON.createGenerator(true);
        gen.writeStringField('ssoProvider', 'xxxx');
        gen.writeStringField('email', UserInfo.getUserEmail());
        HttpResponse response = http.send(request);
        return (String)response.getBody();
    }catch (exception e){
        throw new AuraHandledException(e.getMessage());
  • 2
    Storing sensitive data, even if it's encrypted, on the client side (in JavaScript variables) can expose it to potential attacks like cross-site scripting (XSS). If an attacker can successfully execute an XSS attack, they might gain access to the encrypted data and potentially use it maliciously. Whenever possible, perform sensitive operations and data processing on the server side instead of the client side. This would mean decrypting the data on the server before using it. Commented Aug 28, 2023 at 15:15

2 Answers 2


You need to move the business logic to server side.

Consider using PageReference object or other means to open hostUrlLogin to pass encryptedClaims on server side and avoiding passing that to client

Submit of a form is usually performing a POST HTTP Request. Which can be done in Apex server side code like following.

Still, it is not clear if that form accepts JSON body submission or any other submission types, and that can be corrected if needed. Assuming the form accepts JSON body, we could potentially use the following code

    HttpRequest request = new HttpRequest();
    //request.setHeader('x-api-key', 'xxxxxx');
    request.setHeader('content-type', 'application/json');
    request.setBody(JSON.serialize(new Map<String, Object>{
        'targetUrl' => targetUrl,
        'ssoProvider' => ssoProvider,
        'encryptedClaims' => encryptedClaim
    HttpResponse res = new Http().send(request);
  • can you give a example of how we can do that. Actually once we submit this form a session id is generated( for a dashboard application) and we are able to display different URLs of dashboard Commented Aug 30, 2023 at 7:27
  • well, you haven't provided details about your endpoint, so I could only guess and provide a generic solution, still I am going to update the answer with generic solution details.
    – Patlatus
    Commented Aug 30, 2023 at 8:25

I agree with the other answer (& comment) as a fix but I'am not able to find public documentation from Salesforce side.

We faced similar undocumented vulnerabilities from Salesforce side and they gave us a free submission the next time.

If your package is paid, I would highly recommend raising a support case and asking for public doc else pushing for a free submission the next time.

There has been a rise in undocumented security vulnerabilities from Salesforce side after the recent(March'23) changes in fee structure for package submissions.

  • my client has faced similar additional undocumented vulnerabilities as well, still, Salesforce refused to give any free submission or bypass their undocumented requirements.
    – Patlatus
    Commented Aug 30, 2023 at 8:33
  • Salesforce will never bypass undocumented vulnerabilities but after some argument/debate they granted us free submission twice. Your client's Account Executive can help here.
    – Rohit
    Commented Aug 30, 2023 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .