3

I have a react front-end app and an express server back-end. From my client app, I link to a route on the express server. In that route, I issue a response.redirect to the Salesforce oauth endpoint passing all the appropriate parameters (https://login.salesforce.com/services/oauth2/authorize?client_id=client_id&redirect_uri=redirect-uri&response_type=code&display=popup). This works successfully. I am redirected to the Salesforce login page and can login fine. It makes the callback to my callback URL and then I get an access token without issue. I then am able to make rest API calls without issue. Everything looks good. However, if I look at the browser developer tools Network tab, it displays the redirect url, which shows my client id for my connected app. Why is that? Is there a setting in my connected app that would prevent that? Is there a different way to do a redirect from express? I've seen other apps follow the web server flow and the redirect url is NOT displayed in the Network tab.

From the client app (localhost:3000) there is a simple link to the server.

<a href="http://localhost:3001/authorize">Login to Salesforce</a>

The server app (localhost:3001) has this as the route.

app.get('/authorize', (request, response) => {
    // code simplified for this post….
    response.redirect('https://login.salesforce.com/services/oauth2/authorize?client_id=client_id&redirect_uri=redirect-uri&response_type=code&display=popup');
});

In the network tab of the browser tools, you can see the redirect url that includes the client id of the connected app. It was my impression that this has to be kept secret. Otherwise, anyone could use my connected app to authorize and login. See Salesforce docs.

enter image description here

3
  • 2
    I think you may have some terminology mixed up or something? It'd be helpful if you could provide some code you're using to log in, and some screenshots of expected versus actual behavior. The Client ID isn't a secret, and doesn't need to be protected. As such, your question doesn't make sense as written.
    – sfdcfox
    Nov 12, 2023 at 21:10
  • Added more info.
    – kcamp37
    Nov 12, 2023 at 22:05
  • To your point though, I guess you would need the client id AND secret to get an access token.
    – kcamp37
    Nov 12, 2023 at 22:13

1 Answer 1

3

The Client ID isn't a secret, and this is by design. OAuth login requires additional data to be present, including a redirect_uri that matches the configuration of the Connected App, and for web server connections, requires a Client Secret. The Client Secret should be treated like a password, because if compromised, it might be possible for apps to pretend to be your app. Note that in your specific example, your app would only be able to log in to the same computer (localhost). In the real world, of course, you'd be hosting your app on a server with a domain name, which means, in addition to having the Client Secret, they'd also need to take over your domain or server somehow. That's why OAuth is considered very secure, as it takes at least two security failures to spoof your app (the Client Secret and also taking over your server). You don't need to worry about the Client ID being exposed in the way it is, as it is meant to be exposed.

1
  • Makes sense. Thank you for clarifying.
    – kcamp37
    Nov 13, 2023 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .