I have a client who is interested in embedding or displaying selective information contained on an Account record on their public website. They'd like to do this for a selected group of Accounts that they're easily able to segment and filter in Salesforce.

The idea is that when the Account record is updated in Salesforce, selected information for that organization is automatically updated on the website that website visitors can see.

Before I decide to engage a developer, I'd like to familiarize myself with this topic. I'm wondering if someone can explain what the technical challenge of this request is. And are there any resources where I can learn how this request can be accommodated?

1 Answer 1


Salesforce has several means of access, including guest access through an unauthenticated user account. Here's some documentation on the matter:

  • Force.com Sites: Provide potentially unauthenticated access to a select set of web sites through Force.com.
  • SOAP API: Request data using a WSDL file, and render your information within the page's HTML.
  • REST API: Request data using standard REST interfaces, and render your information within the page's HTML.
  • Integration with the Force.com Platform: A comprehensive document on the various ways you can integrate, including custom REST and SOAP services.

Standard web-based issues apply:

  • CORS: Ability to restrict or share resources across domains.
  • XSS: Vulnerabilities allowing attackers to make your page do things it shouldn't.
  • SOQL Injection: A variant on SQL injection that may unintentionally expose data it shouldn't, although Create, Update, and Delete are protected from the usual SQL injection vulnerabilities, since you can't perform DML operations through SOQL.
  • Security Implementation Guide: Includes the above topics and many more permission and security considerations (PDF).

The easiest method would simply be to set up a Force.com Site, build a couple of Visualforce pages (or however many you need), and then embed those pages in iframes in your HTML. As discussed above, there's various means of accessing the data, various types of security concerns (as above), and so on. However, there's little in terms of security concerns that is intrinsic to salesforce.com as opposed to any other system, with the main differences being implementation-specific.

  • Apologies for the numerous links, but this answer would be incredibly too long to copy everything verbatim. All of these documents can be found in Google in the event of a broken link, however.
    – sfdcfox
    Commented Mar 2, 2015 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .