Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

0
votes
0answers
6 views

Queue owned reports issue

I have a custom report (sales orders with Work orders) but it doesn't filter out by queues Both objects are on PRIVATE in the OWD and I have set the filter to the one in the print screen Any user ...
3
votes
1answer
25 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
0
votes
1answer
37 views

with sharing without sharing vs extension?

While going through manuals, it was mentioned Many times that apex classes will not consider security of logged in user but it will run in system mode and we should add custom controller extension to ...
0
votes
0answers
15 views

Security - See which user exported reports [duplicate]

Is there a way which I can know which user made export to report? Details about the user, date and time and the report name? (A free tool will be great). Thanks!
0
votes
0answers
11 views

How to secure API end points in custom activities?

I have a custom activity created for the journey builder. From a security point of view, how can I protect my REST endpoints? I know we can get the fuel token in the getToken method from postmonger. ...
1
vote
0answers
11 views

Using Protected Component for “Secret Protection” with Unlocked Packages

How do "Protected Components" (Custom Settings or Custom Metadata) function when installed from an Unlocked Package. I was hoping that I would be able to use as "Protected (Managed)" to store "...
0
votes
0answers
19 views

Need help on Salesforce Login discovery

Requirement-I want one of the dedicated profile to be redirected to seprate SSO flow and others needs to redirect to normal username/password flow. I have gone through Login discovery but it seems to ...
1
vote
2answers
54 views

How to temporarily Disable Access for Entire Org?

How to temporarily Disable Access for Entire Org? For all Internal and/or All External users.
1
vote
2answers
28 views

Remove password policies from profiles and have only one central password policy?

In our org, some profiles have their own password policy; these overwrite the general password policy. I would like to return to having only one centralized policy. How can I do that? I cannot find a ...
1
vote
0answers
37 views

CPQ - twin fields not working for certain profiles due to security setting

We are building a twin field in quote and order in the hope that the field value can be automatically copied into order. This is working for other profiles but not sales user since they don't have ...
0
votes
1answer
83 views

Update failed. INSUFFICIENT_ACCESS_OR_READONLY, You do not have the level of access necessary to perform the operation you requested

Background I have created a custom upload component based on this but using ContentVersion rather than Attachment. This custom upload component is being used on a public community page and has an ...
2
votes
1answer
39 views

How do guest communities allow access to detail pages?

Do communities evaluate the Record requested when determining if a page should be accessible? So we have a guest community, which we share some accounts to, for varying purposes. For some childA and ...
0
votes
1answer
29 views

Able To Delete Sobject Even if No permission for User

I have an Invoice Object inovice1, A profile sales1.Profile sales1 have no crud permission for invoice1 object not even read. Also OWD for Invoice object is set to private.Still I am able to insert,...
4
votes
1answer
68 views

Security Question AuraEnabled Dynamic SOQL

Let's say I have an Apex Class like this: public with sharing class AuraUtils { @AuraEnabled(cacheable=true) public static List<SObject> databaseQuery(String queryString){ List<SObject&...
0
votes
1answer
71 views

JWT Bearer flow vs. Username+Password flow in server-to-server integration

Official documentation and some SFSE answers advise against the use of Username + Password flow (Resource Owner Password Credentials Grant in oauth). The JWT Bearer flow is also recommended as a ...
1
vote
1answer
46 views

Sharing of a junction object

What access would a junction object have if one master object has read-write access while the other master object has read access through the sharing rules with organization-wide defaults private for ...
0
votes
0answers
24 views

Can we give user permission to add Notes & Attachments even user's profile has Read only for that object

I have a below setting for the object. ORG wide defaults- Private User's Profile - Read, View All Can I have user to add notes and attachments despite the fact he can't edit object. Thanks
4
votes
0answers
21 views

Calling the UI Api from a community with a custom domain name - getting sun.validator exception [duplicate]

Context: we're using the UI api to get some Record Type dependent picklist values back. This is happening in a community context. In the lower environments (dev, QA) this works without issue. The ...
2
votes
1answer
24 views

Custom Meta Data - Hacking security

Is it secure to set as custom meta data, for example, Credit card details or any other sensitive data? Is there any existing option to encrypt this data ?
0
votes
1answer
43 views

Getting error while adding a trusted site

I am adding some markup in "Head Markup" section of Community Builder(Settings --> Advanced) that references resources from 3rd party websites. Thus, SFDC gives me CSP violation warning in the markup. ...
0
votes
0answers
29 views

Uploading CA-Signed CRT to Salesforce?

I have an existing CA-Signed Certificate (CRT) given to me by my client, and it is needed to be able to make callouts to their external system. I have not found a way to be able to upload a CRT to ...
3
votes
1answer
57 views

Does Case-Insensitive Deterministic Encryption support SOQL LIKE and STARTS WITH statements?

The current Salesforce documentation states that deterministic encryption only supports exact, case-sensitive matches. This is why comparison operators that return partial matches aren't supported. ...
0
votes
1answer
17 views

How to restrict viewing of files and attachments to owner?

We have some sensitive documents which are uploaded as attachments to contact records. We want to restrict viewing of these documents to only the owner of these records. how can we achieve this?
0
votes
0answers
18 views

why a field in the report it shown as id?

I got the same report in internal user and in community user and country relationship its shown as country name with internal user and its sown as id for the community user.
0
votes
1answer
27 views

Account Sharing

I have a user in a role. How do I limit them to viewing the accounts of those below them by Type? Account Type = In Process Client, Active Client and Inactive Client. I've Set up their profile to be '...
0
votes
1answer
107 views

lightning:datatable row action being blocked

I have a 3 row actions for my datatable row. For some reason it is being block and console is saying it is a security error. I am not sure why error is occuring as I am just doing an alert. Here is ...
0
votes
1answer
20 views

Setting Different Permission For Record Owners

I am bit confusing on security part of salesforce. I have a situation where certain fields of an object X has to be disabled for a profile P. But the users in the same profile P, if they are the ...
0
votes
0answers
9 views

Update how Connected App appears in Account Activity

I have setup a Connected App that polls (from a backend server) for updates to a few objects at a set interval. I've noticed that its activity is made to look suspicious in the Account Activity panel ...
3
votes
0answers
20 views

Password policies remain after deleting profile?

I deleted a profile via the Metadata API, and it did not delete its associated password policies. I cannot find the policies anywhere in the UI, but when I pull from production (or any sandbox ...
0
votes
0answers
26 views

Can you deploy transaction security policies

Is it possible to deploy Transaction Security Policies using change sets? These policies are part of the Salesforce Shield Event Monitoring product. Each policy is required to have a user in the "...
0
votes
1answer
52 views

Child Aura Component not Loading for Some Users

Strange situation. This code works perfectly for me, but does not load for some users. I have searched permissions and security on Aura bundles, but cannot find what I need. Here is the code. The ...
0
votes
1answer
302 views

Refused to display 'https://www.salesforce.com/de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

I created VF page (or also to see the VF page inside a lightning component). I added an apex iframe with src="https://www.salesforce.com/de/" (or any other source) from salesforce apex iframe guide....
1
vote
1answer
478 views

Blocked by CORS policy: No 'Access-Control-Allow-Origin' header on the requested resource

I am trying to use a Google Charting library inside a Lightning Aura Component. Component <aura:component implements="flexipage:availableForAllPageTypes"> <ltng:require scripts="{!$...
0
votes
1answer
342 views

Enforce Field-Level Security Permissions for SOQL Queries WITH SECURITY_ENFORCED (Confused )

What is the need of WITH SECURITY_ENFORCED? Only benefit is minimal development experience with security and to applications where graceful degradation on permissions errors isn’t required. If ...
1
vote
0answers
19 views

How is consumer secret key adding security to Oauth 2.0? [duplicate]

I am trying to understand what additional security the the consumer secret(client_secret) for OAuth 2.0 provides. If one want to avoid using the consumer secret when authenticating you can use the ...
0
votes
1answer
45 views

Disabling download attachments to guest users

I would like to disable the possibility to download and read attachments to guest users of my community by requesting them from https://<salesforce-url>/community/servlet/servlet.FileDownload?...
0
votes
1answer
23 views

Cannot grant permission to edit Roll-up summary or formula fields

I am trying to give a profile edit access to a Formula field and Roll-up summary field, I did so with metadata like so: <fieldPermissions> <editable>true</editable> <...
1
vote
2answers
68 views

How to allow edit access to for certain record types only

I need all user to be able to see all opportunities. However, Department A should only be able to edit opportunities assigned to 3 record types (x,y,z) and Department B should only be able to edit ...
0
votes
0answers
29 views

How is this Authentication Option called and how can I implement it?

Recently I was working within my Salesforce Sandbox and when I switched to the Sandbox version of the application, Field Service Lightning, the authentication platform below appeared. I'm interested ...
1
vote
0answers
16 views

How do I test the security of the Salesforce site? [duplicate]

What is the best practice to test security? In my case, I have a site with a database. Salesforce provides good data security of its users. So, in my Org, I have records (contacts, contact ...
5
votes
1answer
71 views

Omit debug logging for specific Apex class

Scenario I do not want information that is processed by an Apex class called SecureProcessor to make it into the debug log, regardless of the level of logging enabled within Salesforce Setup. ...
0
votes
0answers
22 views

record visibilty vs record level access

What are the difference between these? In the Sharing and Visibility Designer certificate exam guide it says: Articulate different security capabilities with respect to record visibility, CRUD ...
0
votes
1answer
230 views

Secure a Landing Page

I'm trying to have my landing Page HTTPS. In this link https://help.salesforce.com/articleView?id=mc_es_create_landing_page.htm&type=5 it's said that there's a check box where you can select the ...
0
votes
2answers
57 views

Sharing Rule is not granting access to a public group

I am working with an object called Scope Library. I want users to have read access by default. I want the group Presales to have read, edit and create access on the object. To give users read only ...
0
votes
1answer
29 views

Storing Credentials - Regharding appExchange product

We are developing AppExchange product where we need to communicate with different third party systems.For Instance , we are getting services from 5 different third party system,a user can have 5 ...
5
votes
2answers
869 views

Is my org's data accessible to Salesforce?

Salesforce protects our data. But does it protect the data from Salesforce itself ? Is my data always visible/accessible to Salesforce?
3
votes
1answer
32 views

Security setting issue in salesforce-OWD

I have a requirement on admin part. I have a profile called vetprofile where the users of the profile needs to see only specific records of an object which have assigned to field value is equal to ...
3
votes
1answer
151 views

How to invoke a flow/trigger if a user fails login attempt?

What Needs to Happen: When a user logs into the org, we perceive the attempt as either Successful (correct password), Failed (incorrect password), or Other. If the user fails the login attempt, a User ...
0
votes
2answers
80 views

How to override Opportunity Org-Wide Defaults Public Read Only

I would like to create a permission set or role which overrides the Opportunity Org-Wide Defaults of Public Read Only, such that users in with the permission set or in the role would only be able to ...
3
votes
0answers
190 views

Trying to call API through Apex with custom security certificate but getting CalloutException

I'm trying to use Apex to call some API endpoints to do some validation for my company. There are some specific properties of these APIs that make it a bit tricky: The APIs are hosted on self-...