Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Will record data be visible via API if shared using sharing records with Guest User on Communities?

We are setting up a public Communities page. This page will publish a flow to capture leads but the flow must have read access to Account and another custom object to do its job. Communities requires ...
-3
votes
1answer
52 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
0
votes
0answers
27 views

Is Salesforce MFA Built In Authenticator alone enough? [closed]

Does Built-In Authenticator (Beta) alone satisfies MFA requirement set by Salesforce ? or we need to setup other mechanism also like Salesforce Authenticator ?
5
votes
1answer
62 views

How to deal with the security of odd standard fields?

We are using the Security.stripInaccessible method to identify fields that don't have the proper DML permission to insert, update etc. It works good for the most part but it gives us some false ...
0
votes
0answers
24 views

Impact of "Enable clickjack protection for customer VisualForce pages with standard headers"

Can anyone tell me what could be the impact in Org if Admin enables session setting "Enable clickjack protection for customer VisualForce pages with standard headers" I totally understand ...
-1
votes
2answers
43 views

Best Practices for Storing API Key?

I have a Lightning Web Component that makes a fetch() request straight from the component's JavaScript. For testing and development I've simply stored the API key as a variable, but I'd like to back ...
0
votes
1answer
31 views

Is it ok to store a bearer token in a custom field in the user object [closed]

I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. ...
5
votes
1answer
81 views

Is there a security hole in Salesforce's documentation?

I was looking at Salesforce's documentation for implementing an OAuth callback and I noticed they are accepting a "sfdc_community_url" from the client, which should normally only ever be a ...
0
votes
0answers
14 views

Security in Cloudpages when using Java Script flow frame-work to call app and customer can input their details on that app called by Javascript

We are developing a cloudpage (Landing page) in marketing cloud and on that landingpage there is a button called "Get Started" so once customers land to this cloudpage they can click on &...
0
votes
2answers
47 views

Salesforce Backup Process

I would like to be informed about Salesforce Backup Process (Security Management). I would like to know more about the Standard Recovery Process if any. How often is the Salesforce backup taken? ...
0
votes
0answers
25 views

Unable to disable XSS-Protection

I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
0
votes
0answers
34 views

REST API. Sending sensitive data in URL . Security issue

I have a security issue. I built an app that interacts with WordPress and its plugins via REST api, gets and posts some info and syncs it with Salesforce data. I have apex classes that perform HTTP ...
0
votes
1answer
22 views

Can I view a record if that record type / page layout is not assigned to me in salesforce

If I have access to 2 record types of an object and someone who has an access to a 3rd record type assignes me that record (which was created using that 3rd record type), will I be able to view it?
0
votes
1answer
24 views

Auth Provider configured as High Assurance continues to prompt users for MFA?

Our users currently log into our org using their salesforce username and password credentials along with their registered verification method of choice for Salesforce's own MFA prompt. We're now in ...
0
votes
2answers
45 views

What is isCreatable and isUpdateable for FIELDS in GUI

Where can I find and enforce "CREATABLE" and "UPDATEABLE" options for fields? Because, i am able to check the permissions in Apex(below statements) whereas, not able to find what ...
1
vote
0answers
33 views

Can RSA SecurID be used as Salesforce MFA?

Next year MFA will be required (Salesforce MFA Doc) and the customer has RSA SecurID as 2FA for other applications, We would like to know if we can use SecurID as a third-party authenticator app for ...
0
votes
0answers
10 views

How to provide CRUD permissions over groupmember object

For a non-admin user(Salesforce Platform license) with minimal/specific permissions, we want user to access groupmember record programmatically, for CRUD operations (especially Delete). However, while ...
0
votes
0answers
16 views

Salesforce implicit sharing - does access to account records via implicit sharing open up access to contact records as well?

If OWD is set to private and access to case record opens up the access to account Record via implicit sharing, will that also open up the read only access to contacts related to those accounts? ...
0
votes
0answers
8 views

Why can the member of a delegated group assign profiles not listed as assignable?

Two sandboxes are set up with the same assignable profiles in a delegated group under Delegated Administration. In one sandbox, users can only set up new users with one of the assignable profiles ...
2
votes
1answer
60 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error thrown in random places

Recently I've started getting error message: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Access to entity 'AIInsightValue'...
2
votes
1answer
49 views

Marketing Cloud SSL DIY Setup Cheaper?

I'm a marketing cloud and ssl newbie, so forgive this newb question. So, we have 2 business units with SAP needing 4 SSL Certificate, I contacted our account exec to get a quote. The total was ($6.5k) ...
0
votes
0answers
19 views

Visual Force expose on External Site - Manage access

I have a need to create a visual force page that will be accessible on an external web site, it will be displayed in an Iframe. The page will be accessible only for specific web site user after login. ...
0
votes
1answer
27 views

How to restrict users to access accounts they do not own associated with cases they do own

We have two companies with their seperate roles hierarchy under same organisation. The hierarchy is same for both companies CompanyA Manager - CompanyA Processor - .. CompanyB Manager - CompanyB ...
0
votes
1answer
204 views

Should Named Credentials be used to store an API Callout Bearer Token?

Problem I have a straightforward REST API callout in apex. request.setEndpoint('https://api.websitename.com'); request.setMethod('GET'); request.setHeader('Authorization','Bearer ...
2
votes
0answers
22 views

Salesforce security issue - Account owner's role of community user is given access to accounts the community user is linked to via cases

We have a security requirement where certain accounts should only be visible to a certain public group. To enable this we have a checkbox on the account and set our OWD to private. Any account with ...
3
votes
1answer
102 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
0
votes
0answers
19 views

Marketing Cloud SSO Config Failure - ReplyURL mismatch

I did all the configurations as mentioned in the steps here: Salesforce Marketing Cloud - Azure SSO Implementation I am redirected to IdP login screen, when I load the Marketing Cloud SP Url. But then ...
1
vote
1answer
255 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
0
votes
1answer
75 views

Whitelisting Salesforce IP addresses

We want to integrate Salesforce with one of our in-house applications. However, my networking team does not want to open the IP address (128.245.0.0/16 means 16,000 IPs) . How can we restrict the IP ...
7
votes
0answers
93 views

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

We are looking at setting up our Salesforce org as a public and secure endpoint target for a 3rd party application (Housecall Pro) which will be sending us webhook calls. The only rub is they cannot ...
3
votes
3answers
112 views

Is there a working Desktop Authenticator App for MFA? (with no mobile device involved)

I have very mixed feelings towards the enforcement of MFA by Salesforce, which as a consequence enforces the usage of authenticator apps. I have over 400 developer orgs to deal with. I have to login ...
3
votes
1answer
67 views

How to securely deploy secret key in custom metadata - 2GP Managed Package

I have recently created a managed package and I am preparing it for security review and final deployment. In the code I need to sign JWT used to authenticate against external API, for this purpose I ...
4
votes
2answers
359 views

How can I encrypt a string in Apex in a way that an external system can decrypt using C#?

Our security team has found an issue in our lightning experience site where a link to an external system is adding the account # in the URL. That system is then using that account # to display data on ...
0
votes
0answers
26 views

Unable to see data in role hierarchy to above users

I have a chief sales officer role under CFO role, I gave permission in OWD public Read/write but I am unable to see the data of chief sales officer's in CFO user. both of user have assigned a profile ...
0
votes
1answer
103 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
1
vote
1answer
102 views

Named Credential ignores authorization header in apex

I have created a named credential, myNamedCredential, where Generate Authorization Header is True. When I look at the codebase, we have a trigger with code that will set the Authorization Header using ...
0
votes
1answer
93 views

When should we whitelist Community Cloud IP ranges? [closed]

As per the article Salesforce IP Addresses and Domains to Allow : Recommended for seamless access: Our best practice is to allow our entire set of IP ranges. This is to ensure our login pools can ...
3
votes
0answers
47 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0
votes
1answer
38 views

Trailhead login issue and security question [closed]

i am facing an issue. i was practicing something so i made a trailhead account. after timeout logout, i didnt know the password. when i click forgot password i received an email. after clicking that ...
0
votes
0answers
18 views

SSH Private Key is not accessible file Transfer Activity

I have a pair of SSH keys from my customer and I want to update them into Salesforce to use for Encryption and Decryption. I have no problems with an encryption key, it works just fine. But when I am ...
3
votes
1answer
36 views

Locking Down OAuth App Access in our Salesforce Org

I am looking to control Salesforce OAuth Application Access so it requires admin approval prior to being connected. Current Issue All employees at our organization have OAuth Access to Salesforce. ...
0
votes
1answer
58 views

Reports using different interfaces [closed]

I have created a report using classic but when another user creates the same report in lightning, some records are not displayed.
0
votes
2answers
81 views

Deploying an incomplete profile: how does Salesforce fill in the gaps?

If I create a blank profile in DX (minimal info, no object/field level security) and deploy it, the resulting deployed profile still has some object and field level security. How does Salesforce ...
2
votes
1answer
36 views

How to automatically apply Release Updates?

I see the with the new Release Updates page there is now an API to list release updates in the Tooling API as a ReleaseUpdate sobject. There is also a ReleaseUpdateStep and ReleaseUpdateStepLog ...
0
votes
1answer
82 views

Restricting access to create Reports in Salesforce

We have three different sister companies within our salesforce org. Account and Contacts are readable for all users irrespective of Business units. However, I need to provide create and export report ...
0
votes
1answer
35 views

Security with Mixed SObjects

I am attempting to find best practices around mixed SObject security. When I am using DML statements I validate either through "with SECURITY_ENFORCED" or through {SObject}.SObjectType....
0
votes
0answers
89 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
0
votes
1answer
46 views

Is this better to store system-defined credentials in a middleware layer or in custom settings?

For an outbound integration from Salesforce to External System, is this better to store system-defined credentials in a middleware layer or in Custom Settings or in Static Resource? Is this secure to ...
7
votes
1answer
150 views

Workbench end-of-life? [closed]

I have my own instance of Workbench running on Heroku and have recently started receiving the following email after deployment: Your recently built app XXXXXX is using the Heroku-16 stack, which is ...
0
votes
1answer
29 views

Need help with Data Security requirement

Below is my requirement: There are multiple programs within the org and I have this requirement. Part 1: Profile A should only be able to see Program A data (Accounts, Customers, etc..) Part 2: ...

1
2 3 4 5
17