Questions tagged [security]
Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.
860
questions
1
vote
0
answers
28
views
Site.login() URL is not working on production org
We have an Experience site with a custom Apex login controller.
When a user logs in, the controller captures the URL from the PageReference returned by Site.login() and sends the login URL to the user ...
- 349
0
votes
1
answer
23
views
How can I create a enhanced transaction security policy to allow only POST method in API event
I want to set some alerts and restrictions for API calls using Shield Event monitoring. I am not able to figure out how can I create real-time monitoring using Transaction security policy to allow ...
- 1
-1
votes
0
answers
19
views
Screen flow that asks the running user for their password then displays sensitive information on a screen
I'm looking to add a button to the Account page layout that will launch a screen flow asking the running user their salesforce login password, ideally i would like the flow to check this is correct ...
- 9
5
votes
3
answers
289
views
Are custom SOQL- and DML-libs superfluous with USER MODE?
As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
- 36.4k
3
votes
1
answer
153
views
For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?
When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given ...
- 201
0
votes
1
answer
59
views
When is the External Service Scan required in Salesforce Security Review?
I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
- 553
-1
votes
1
answer
54
views
How to enable/disable button based on user edit access in LWC datatable?
I am building a Lightning Web Component (LWC) that retrieves data from Apex and displays it in a datatable. Currently, the LWC component retrieves all records from Apex, but I want to fetch that the ...
- 28
1
vote
1
answer
88
views
JWT Security Best Practice with Certificate
Any security experts here? We have built out a JWT authentication flow with a client, but they keep asking for more and more information. So far we have provided:
Client ID
Client Secret
server.key (...
- 1,050
0
votes
1
answer
18
views
Evaluating Salesforce Exchange App - FilesConnect
I found what looks to be a very new app (release date - 11/24/2022) on the AppExchange and I want to know if there's a good way to do due diligence before downloading. There are no reviews besides ...
- 11
0
votes
2
answers
39
views
Using SOQL Injection to delete data
I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
- 153
0
votes
0
answers
116
views
Salesforce : How do we block a User from using query with Rest API?
We are integrating an External System (Drupal) with Salesforce . The corner case being , A user who may get access to the shell of the server the Drupal Instance is running , may have access to all of ...
1
vote
2
answers
100
views
Is it a security risk if contact record id is exposed in URL
Could you please let us know whether it is a security issue if contact record ID is exposed in URL ? What is the best way to avoid exposing the record ID in Custom community URL ?
- 23
1
vote
0
answers
86
views
Salesforce equivalent of AWS Secrets Manager?
We have Apex code with callouts that use hardcoded credentials. Our organization wants to replace the hardcoded credentials with a secure key store that we can retrieve the credentials from. We are ...
- 159
0
votes
0
answers
35
views
How to prevent users based on roles or profile from modifying the FROM address
We have two roles for users in our Salesforce Org:
Agents
Supervisors
We leverage permission sets for giving them access into the system.
Supervisors generally have more access to the system. I ...
- 1,195
3
votes
2
answers
168
views
Interpreting the code in emails SFMC
I am struggling with the problem of displaying a personalized field (first name) in email.
The problem is that sometimes can happened situation when person, which is registering to the company's ...
- 33
-1
votes
1
answer
84
views
How does Ownership in manual sharing a single record work?
I was asked a question: If A and B are two users and A manually shares a record he owns to User B and then he leaves the organization. Now a third User comes and gets the Ownership of the record in ...
- 63
0
votes
1
answer
198
views
Restrict User Access to Object by Field Value [duplicate]
Is there a way to restrict a user's access to a subset of objects by field value? Essentially I'm trying to create a profile that only has access to orders/accounts/contacts that have a boolean field ...
-1
votes
1
answer
71
views
How can I make flow to be run by specific user only?
I have a button on opportunity record page which calls a flow, I want the flow to be accessed by specific set of users and no other user should be able to run the flow except admins. Is it possible? I ...
0
votes
0
answers
34
views
Security for Custom Objects (Lookup Relationship)
I am setting up security for an org. We have a lot of Custom Objects that need to be set to Private. I then need to create Sharing Rules to share a subset of records with specific users. However, ...
- 3
-1
votes
1
answer
96
views
What happens when Password setting is updated?
I am trying to improve our Salesforce Org Health Check score.
I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
- 89
0
votes
0
answers
22
views
What are the different possibilities in which the Manager would have got access to the record?
We have a custom object with the following Security settings:
OWD is private
All/profiles have Read, Create, Edit permissions
Grant Access Using Hierarchy is disabled.
There is only one. owner-based ...
user122907
1
vote
1
answer
40
views
Gack Id Error ID: 2058118216-46834 (-1126405779) for setting Visualforce Page Security Settings
When I tried to create a new Visualforce Page on a new scratch org, and grant access to all profiles, I received an error Error ID: 2058118216-46834 (-1126405779).
Why does it happen? What is the ...
- 14.8k
1
vote
2
answers
199
views
How to make the code resource URL private for SFMC use only [closed]
I need to restrict the access of code resource endpoints to SFMC use only. Some update codes are added in SSJS which will be called from SFMC. In case the URL is exposed somehow, I don't want to have ...
- 125
0
votes
0
answers
140
views
How to get users that have access to a record with given ID?
I have an ID of a record from the custom object Job_Application__c.
Is there any SOQL query or Apex method that enables to get IDs of users that can see that record? (I mean sharings to that given ...
- 7
0
votes
1
answer
49
views
Why is an API User with R/W access to a lookup field, getting an INVALID_FIELD error?
My API user makes the following query in Salesforce via the Standard REST API. They have Read / Edit privileges on the Contact__c field and Modify All on the Channel__c object. They do not have access ...
- 10.4k
2
votes
1
answer
75
views
Prevent flows from writing sensitive data to debug logs in plaintext
We have a screen flow that collects a password from the user using a Password field component. That masks the input on screen, but when looking at debug logs, the value of that field gets written to ...
- 125
1
vote
0
answers
61
views
Secure key storage to validate webhook signature
It's the {current_year}. How does Salesforce suggest storing API keys when they are used outside callout context (solved very well using Named Credentials)?
Looking at previous discussion, "...
- 4,676
0
votes
0
answers
12
views
User-invoked disabeling of an account to run in a flow for their specific public group
I'm really scratching my head on this one. I'm new to Salesforce (8 months) and I've created a flow to automate our AR process.
We have 89 public groups that control privacy. Right now, the flow is ...
0
votes
1
answer
59
views
Is fixing "Apex Code Quality" issues necessary for passing security review?
I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
- 3,355
-1
votes
1
answer
243
views
SFDC's out-of-the-box email to case security standards
We are in the midst of HITRUST certification info-gathering and remediation steps, and because we have SFDC's out-of-the-box email to case as a communication tool, we are looking to understand its ...
- 1,195
0
votes
0
answers
79
views
Giving community users access to records via junction object
I have a junction object called Junction__c. It has Master-Detail to PersonAccount and another object called Mortgage__c.
I have a checkbox on Junction__c called Access_Granted__c. When this checkbox ...
- 466
0
votes
1
answer
41
views
How can I stop Email Preview from executing API calls?
Trying to institute tokenized links in the emails that will allow users to sign-in to the company's website without having to enter credentials. Tokenized links are generated by the company backend on ...
- 184
0
votes
0
answers
17
views
Granular Control on Chatter Posts
I have a use case where we have a group of Profiles that need to have access to edit their Chatter Case comments for 24 hours and then those posts become locked for them and no longer editable. They ...
- 1
0
votes
2
answers
167
views
How to control edit access to Role?
I have a role Sales Manager. The sub roles of Sales Manager are Sales Rep A and Sales Rep B.
The records created by Sales Rep A user and B user are seen by Sales Manager. It is done by Role level ...
0
votes
1
answer
70
views
Cannot create IsAccessible statement for User object
I'm trying to create this statement:
if(User.sObjectType.getDescribe().isAccessible()){
User userData=[SELECT id, Profile.Name FROM User WHERE id=:user.id];
return userData.Profile....
- 185
0
votes
1
answer
245
views
Visualforce and LWC Security Concerns [closed]
I’m trying to find an example of security issues in VF or LWC. If that security vulnerability really exist in the code, and if that vulnerable code is deployed to a Salesforce prod org or Salesforce ...
- 23
1
vote
0
answers
52
views
"Nested" Named Credential Callout
I have a named credential, let's call it NC1, setup for a custom AWS endpoint. This works great using the endpoint and an access key. However, as part of the body of NC1, I need to send an auth ...
- 349
0
votes
1
answer
423
views
Establish a connection from Salesforce to VPN
Some of our API endpoints cannot be accessed from SFMC without connecting to the VPN network. We need to fetch information from these endpoints.
Is VPN tunneling possible from SFMC? currently, it is ...
- 3
0
votes
1
answer
550
views
Gave User Read Only Permission In Sharing Setting but Able to Edit Records when OWD is Private
I want a user to see all the records of Quote object of other users based on some criteria, I created a sharing rule on the opportunity to share records with that user and gave read-only permission ...
- 3
0
votes
0
answers
279
views
Allow only 1 profile to Merge Accounts
Use Case:
Only users from a profile 'CSX' should have the ability to Merge Accounts. No matter who owns the Acount, when Accounts need to be merged only this profile can Merge the records.
Security ...
- 787
0
votes
2
answers
122
views
SalesForce Workbench Architecture
We are performing a security review of the WorkBench tool before allowing external consultants access to our Salesforce organization for viewing the structure and relationships to develop reports.
I ...
- 11
0
votes
0
answers
79
views
Save Custom logout url through Apex code
In Setup >> Security Controls >> Session Settings >> Logout Page Settings. System Admin can define Logout Page URL. Can we set this via Apex Code or Metadata API ?
- 705
2
votes
2
answers
469
views
Lightning Web Security breaks LWC with svg use tag
When there is a LWC using svg use tag like suggested on Lightning design system site and Lightning Web Security is turned on (the setting Use Lightning Web Security for Lightning web components on ...
- 14.8k
2
votes
1
answer
104
views
How often does Salesforce change the keys at https://login.salesforce.com/id/keys?
How often does Salesforce change the keys change at https://login.salesforce.com/id/keys ?
Context
A client wants to verify the JWT signature generated for Salesforce's OpenID Connect token
However, ...
- 2,102
1
vote
1
answer
226
views
What permissions on a profile/permission set should be considered "privileged user" or "system admin" access?
I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because ...
- 477
1
vote
1
answer
70
views
How is attachment access controlled by record level
By looking at the permission set and profile metadata files, I don't see a place defining the access to contentDocument or ContentVersion so I originally assumed it should be controlled by parent. ...
- 12.9k
1
vote
1
answer
29
views
API Enabled User Use Which Sharing ? Extenal Default or Internal
I am making a user API Enabled. By turning ON the permission 'API Enabled'.
What I am trying to figure out is, when this user is accessing data from salesforce with an external application.
Which ...
- 371
-1
votes
1
answer
123
views
Security setting on report type
How can I allow reporting on only one report type(there is only one custom object in this report type) for a particular profile in salesforce? All other report types should be hidden/not selectable by ...
0
votes
0
answers
64
views
Enforce CRUD on single record DML statement
As the title suggests I am trying to enforce CRUD on a DML statement for a single record. I see the stripInaccessible() method takes in a list of sObjects. Is there an equivalent method for a single ...
- 349
0
votes
1
answer
196
views
Not Able To Access Records In Role Hierarchy
I am a salesforce developer but new to admin. Tring to understand security settings using role hierarchy and having an issue or confusion here. I'll try to explain this below.
I have two roles in the ...
- 21