Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
1answer
17 views

Security with Mixed SObjects

I am attempting to find best practices around mixed SObject security. When I am using DML statements I validate either through "with SECURITY_ENFORCED" or through {SObject}.SObjectType....
0
votes
0answers
17 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
0
votes
1answer
33 views

Is this better to store system-defined credentials in a middleware layer or in custom settings?

For an outbound integration from Salesforce to External System, is this better to store system-defined credentials in a middleware layer or in Custom Settings or in Static Resource? Is this secure to ...
5
votes
1answer
76 views

Workbench end-of-life?

I have my own instance of Workbench running on Heroku and have recently started receiving the following email after deployment: Your recently built app XXXXXX is using the Heroku-16 stack, which is ...
0
votes
1answer
26 views

Need help with Data Security requirement

Below is my requirement: There are multiple programs within the org and I have this requirement. Part 1: Profile A should only be able to see Program A data (Accounts, Customers, etc..) Part 2: ...
10
votes
0answers
61 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
0
votes
1answer
18 views

Validation Rule on Task AssignedTo Standard Field

I have put the following Validation Rule on the AssignedTo field on Task to avoid changing task owner if the logged in user is also the owner of the task NOT(ISNEW()) && $User.ID = OwnerId &...
0
votes
0answers
13 views

Why my community plus user cannot see child records of a parent that has been shared with him?

I'm still trying to find my sea legs with Salesforce record access and it's quirks, so please walk me through your thought process, I might be missing something really obvious here. I have 3 custom ...
0
votes
0answers
19 views

I wanted to know that under what circumstances is the sharing button enabled on the detail view for a record?

Now, I have a custom object for which I have the OWD set as private, then I am able to see the sharing button on the detail page of the record, but even if I set it to public read/write, I can still ...
0
votes
0answers
16 views

Lightning out - provides access to the org

When I load a site page that contains a Lightning component, access to the org opens. That is, in the neighboring tab, I can take a working link and go to the accounts for example. (the browser is ...
0
votes
0answers
23 views

Transaction Security Policy - Stop connectors(Data loader, Excel connectors, workbench, etc.. ) to do DML in salesforce

I got a requirement where I need to stop my users to perform the update, insert, and upset from any connector(Excel connector, workbench, data loader, etc..) even if they have access in the profile. I ...
0
votes
0answers
27 views

Access on UserDevice sObject

I am trying to query on UserDevice sObject but in the documentation it is mentioned "You must have View Devices enabled to see devices.". So can anyone please tell me how to do this to be ...
0
votes
2answers
31 views

Not able to find reset token option in sandbox instance

I am not able to find the Reset Security token Option under the settings option in my partial sandbox instance. Can someone please let me know how to find it. Or if I am missing out on anything. I am ...
1
vote
1answer
56 views

Re-enabling the ability to impersonate External Users via “Log in to Experience as User” button (Spring 21)

Some Platform Users in my org used to be able to impersonate Community (now "Experience") users from the Contact record by using the "Log in to Community as User" button. After ...
0
votes
0answers
6 views

Go to a public Community Home page from base URL

The goals is to have a public home page of a community. That the users do not have to login to see. And when users hits the base URL of the community it is redirected to that public home page. https://...
0
votes
1answer
59 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
0
votes
0answers
29 views

Salesforce security - controlling app access to the org

Guess I wasn't clear about my question - it goes to the question of Salesforce Security. How does a SFDC Admin control the applications that access the org. The following is explanation of the issue: ...
1
vote
1answer
20 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
4
votes
1answer
73 views

Why is stripInaccessible removing an M-D field?

I am building and LWC which uses lightning-record-edit-form to create an object, then calls an Apex controller method to create a list of M-D children of the newly created object. In my current test, ...
0
votes
0answers
20 views

Cannot get custom font to work in Community Pages- have tried many things to fix

I followed these instructions to the letter in my Dev Org: https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_customize_font.htm I've tried ...
1
vote
1answer
52 views

Winter '21 LWC “script-src” issue with lightning-record-form

We have an LWC component that leverages the lightning-record-form to allow records of a specific custom object to be created or edited. The form uses an object layout to define the fields to edit, and ...
0
votes
0answers
21 views

connecting roles to records

In this tutorial, the instructor configures roles hierarchies, but in don't have the same options of what to do with them: tutorial: Who Sees What: Record Access Via Roles (Lightning Experience) Her ...
4
votes
3answers
84 views

What is the risk of not performing Field Level Security (FLS) checks on internally developed Apex code?

I see more and more information about the importance of performing FLS checks before SOQL and DML operations, using the Security.stripInaccessible method, e.g. in the Winter '21 PD1 certification ...
1
vote
1answer
74 views

How to implement PKCE flow in Salesforce

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
1
vote
1answer
76 views

PCKE flow Salesforce for OAuth 2.0

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
0
votes
0answers
22 views

Private Settings managed packaged issue

Have someone ever faced package named Private Settings? There is need to take a glance at the classes methods if it possible. I'm gonna use that one to reach out custom API but don't have a clear idea ...
4
votes
3answers
187 views

How to see encrypted field in System mode?

I can see and use encrypted field in user mode with View Encrypted Data permission. But in System mode it always as "stars" (***********). Is it possible to see it in the System mode as ...
0
votes
0answers
37 views

Automatically Running Salesforce Data masking package

I have a task to automatically run the Data mask package provided by Salesforce after sandbox get refresh. I am looking to write a batch apex but how should I do it . Can I run by accessing the ...
-1
votes
1answer
16 views

split userPassword and securityToken

Let's say we have 3rd party api that should reach salesforce. we want to transfer password and security token in using only one custom http header. is it possible to split these values? e.g. ...
0
votes
1answer
68 views

Why does the FFLIB framework enforce CRUD security and sharing rules by default for Domains?

In FFLIB, a Domain enforces CRUD security and sharing rules by default. We use FFLIB Domains for implementing triggers. In the Salesforce standard, triggers run in system context, meaning they don't ...
1
vote
0answers
51 views

File not showing preview when created by Force.com Site Guest User (i think after Summer '20 Release)

I saw that since Summer 20 changes to the rights of the Force.com Site have taken place (https://releasenotes.docs.salesforce.com/en-us/spring20/release-notes/rn_networks_guest_user.htm) Currently I ...
0
votes
0answers
15 views

Opportunity Sharing Rule creation option not available

In one of my org I changed the OWD for Opportunity from Public Read Only to Private. However, I can't see the option to create a new sharing rule for Opportunity. What could be the possible reason for ...
0
votes
0answers
30 views

Grant View All Accounts permission for a Community User

We have a community and community users holds customer community login profile. Basically, Account and ChildObject__c have been shared with community users with a sharing set according to the below ...
0
votes
1answer
33 views

How can I give read access to User for users on a Customer Community licence?

I have a lookup field called Requested_By__c which looks up to User. It is on a custom object called Sample__c. In my LWC (sampleHelpInfo) I am using @wire to get the sample record and the ID of the ...
1
vote
0answers
7 views

Individual lightning Dashboard access to users

I have a requirement where there are specific users who should have view access only to few dashboards in a folder but not all. I know that we can manage folder access but is there any way we can ...
0
votes
1answer
59 views

Retrieving record IDs after inserting a List of objects [duplicate]

I Have used Enforce Security With the stripInaccessible Method to Create Record in Account Object List<Account> newAccounts = new List<Account>(); Account a = new Account(Name='Acme ...
9
votes
0answers
161 views

Font Awesome fonts are not being loaded after “Enable Secure Static Resources” activated for testing

Recently I have encountered the feature "Enable Secure Static Resources" on the release update (that was already being postponed as I am writing this) and read this question talking about it ...
16
votes
0answers
1k views

What is the impact of the Release Update: “Enable Secure Static Resources for Lightning Components”? (due 2020-11-29)

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To ...
1
vote
0answers
31 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
1answer
57 views

Why are Apex Class Permissions being enforced in sandbox but not in production?

In our full sandbox, our QA engineer has observed that one of our Lightning Components is failing. Upon further inspection, it turns out that the Apex class the component is calling is not accessible ...
0
votes
0answers
27 views

Keeping a ViewAllData permissionset viewing all fields

I have a permissionset which I want to grant broad read-only access to nearly all fields and objects. I've granted the permissionset the ViewAllData permission already, but that permission does not ...
0
votes
1answer
47 views

How to use variables in JavaScript without exposing them in the browser?

I want to use the Bee Template API inside my Visualforce page. So, this is the code I used: //Visualforce Page <apex:page showHeader="false" controller="...
0
votes
1answer
88 views

Is there some standardized way to ensure custom settings are not automatically cloned into Sandboxes?

Among other things, our custom settings include URLs for production servers and credentials to access those servers. Arguably, some of these things should probably be Named Credentials, but the ...
0
votes
1answer
54 views

Best way to limit visibility to Synchronized Data Extensions in Dev Org?

What is the best way to limit the visibility to Synchronized Data Extensions as well as their ability to view the Synchronized Data Sources & Objects in Marketing Cloud from other users? Do we use ...
0
votes
0answers
32 views

Approval Email Notification Template Is Not Triggered By All Users

I have created an Approval submission email notification template in Dev sandbox. This is working for all the users who ever submit the approval process, email is submitted to queue members/queue ...
3
votes
1answer
86 views

FLS check in 2GP

I've created a new 2GP package. Since it is going to be released to AppExchange, I've implemented a generic CRUD and FLS check for every place I contact with the Database in my Apex code. e.g. ...
2
votes
2answers
62 views

Does a library exist for securely querying for arbitrary data?

I'm looking for a library we can use from Aura and Lightning Web Components in particular, to take some sort of request and return the data for it, but only if/what the user can see. Per their secure ...
0
votes
1answer
35 views

Marketing Cloud Roles & Visibility, if allow and deny are not checked this means that it is not visible?

When setting up users in their respective roles, if the allow and deny boxes are not checked this means that the feature/capability is not visible to them correct?
0
votes
0answers
51 views

APEX PMD Security Error

Added Chrome PMD Extension Salesforce Advanced Code Searcher to run PMD script for my Apex Controller. Below Code doesn't shows any security error. if( Programs__c.SObjectType....
0
votes
0answers
160 views

PMD Apex ExcessiveClassLength & ExcessivePublicCount Rule error

Getting the following error message when I Ran the PMD scripts for Apex Class. ExcessiveClassLength -- Avoid really long classes. ExcessivePublicCount -- This class has a bunch of public methods and ...

1
2 3 4 5
16