I'm looking to add a new Named Credential (not legacy) to my managed package. There's a similar question here, but that's in relation to legacy named credentials.
Looking at the documentation, it says the subscriber can update the URL.
Isn't this a potential security breach? Or is the doco wrong on this?
If I can't stop the subscriber changing the URL, what alternate approach should I be taking for httpreqeusts from managed package code?
i.e. The subscriber could change the URL to a postman URL and see the headers and and tokens/secrets being passed through.
Doco for reference:
Only Package Developer Can Edit
- Label
- NamedCredentialType
- Legacy Named Credentials only (deprecated and unsupported in future releases)
- Endpoint (deprecated)
Both Package Developer and Subscriber Can Edit
CalloutOptions
- AllowMergeFieldsInBody
- AllowMergeFieldsInHeader
- GenerateAuthorizationHeader
NamedCredentialParameters
- AllowedManagedPackageNamespaces (only subscriber editable)
- Authentication
- ClientCertificate (only subscriber editable in 2GP)
- HttpHeader
- OutboundNetworkConnection
- Url
Legacy Named Credentials only (deprecated and unsupported in future releases)
- AuthProvider (deprecated)
- AuthTokenEndpointUrl (deprecated)
- AwsAccessKey, AwsAccessSecret, AwsRegion, and AwsService (all deprecated)
- Certificate (deprecated)
- JwtAudience, JwtFormulaSubject, JwtIssuer, JwtSigningCertificateId, JwtTextSubject, and JwtValidityPeriodSeconds (all deprecated)
- OauthRefreshToken, OauthScope, and OathToken (all deprecated)
- OutboundNetworkConnectionId (deprecated)
- Password (deprecated)
- PrincipalType (deprecated)
- Protocol (deprecated)
- Username (deprecated)
