Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
-3 votes
0 answers
29 views

Monitoring Sharing Rules?

In our salesforce there are different type of sharing rules in different record how can we monitor which type of sharing rules will be attach in record
user avatar
0 votes
2 answers
44 views

SalesForce Workbench Architecture

We are performing a security review of the WorkBench tool before allowing external consultants access to our Salesforce organization for viewing the structure and relationships to develop reports. I ...
user avatar
0 votes
0 answers
23 views

Save Custom logout url through Apex code

In Setup >> Security Controls >> Session Settings >> Logout Page Settings. System Admin can define Logout Page URL. Can we set this via Apex Code or Metadata API ?
user avatar
2 votes
2 answers
63 views

Lightning Web Security breaks LWC with svg use tag

When there is a LWC using svg use tag like suggested on Lightning design system site and Lightning Web Security is turned on (the setting Use Lightning Web Security for Lightning web components on ...
user avatar
  • 13.2k
2 votes
1 answer
45 views

How often does Salesforce change the keys at https://login.salesforce.com/id/keys?

How often does Salesforce change the keys change at https://login.salesforce.com/id/keys ? Context A client wants to verify the JWT signature generated for Salesforce's OpenID Connect token However, ...
user avatar
  • 2,092
1 vote
1 answer
19 views

What permissions on a profile/permission set should be considered "privileged user" or "system admin" access?

I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because ...
user avatar
1 vote
1 answer
19 views

How is attachment access controlled by record level

By looking at the permission set and profile metadata files, I don't see a place defining the access to contentDocument or ContentVersion so I originally assumed it should be controlled by parent. ...
user avatar
  • 12.7k
0 votes
1 answer
20 views

API Enabled User Use Which Sharing ? Extenal Default or Internal

I am making a user API Enabled. By turning ON the permission 'API Enabled'. What I am trying to figure out is, when this user is accessing data from salesforce with an external application. Which ...
user avatar
-1 votes
1 answer
29 views

Security setting on report type

How can I allow reporting on only one report type(there is only one custom object in this report type) for a particular profile in salesforce? All other report types should be hidden/not selectable by ...
user avatar
0 votes
0 answers
24 views

Enforce CRUD on single record DML statement

As the title suggests I am trying to enforce CRUD on a DML statement for a single record. I see the stripInaccessible() method takes in a list of sObjects. Is there an equivalent method for a single ...
user avatar
  • 187
0 votes
0 answers
28 views

Not Able To Access Records In Role Hierarchy

I am a salesforce developer but new to admin. Tring to understand security settings using role hierarchy and having an issue or confusion here. I'll try to explain this below. I have two roles in the ...
user avatar
0 votes
0 answers
24 views

Visualforce Public Form DoS Security

I have created a public registration form for clients. No login/credentials are required to submit the form. It is reachable via a custom url of this format: my-custom-subdomain.force.com. It is built ...
user avatar
  • 11
0 votes
0 answers
55 views

Problem Logging In - No_Oauth_State: State was not sent back

I would like to connect GoToApi with Salesforce Org. According to their documentation, I need to go to this URL to get the authorization code: https://api.getgo.com/oauth/v2/authorize?client_id={...
user avatar
  • 285
0 votes
0 answers
56 views

Custom Email Confirmation Page in Experience Cloud

I have a problem, when Customer Community Login user change their email, old and new emails with address confirmation are sent by SF and standard page with button opens. Is there any way to replace ...
user avatar
0 votes
0 answers
28 views

lightning:recordEditForm not rendering when user has read-only data-level security

I have a custom object that is a child of Opportunity so its data-level security is controlled by its parent (Opportunity) sharing settings. All of my user Profiles have Object-level permissions set ...
user avatar
4 votes
2 answers
163 views

LWS - Apparent difference in behavior using data returned from Apex call

Prior to enabling LWS in Spring '22 we were able to successfully 'modify' objects returned from an Apex Call. After enabling LWS we cannot modify the data. Allow me to give an example. Below is some '...
user avatar
0 votes
1 answer
23 views

Does Upgrading Major Version Number Trigger Security Review

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
user avatar
0 votes
1 answer
45 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
user avatar
  • 13.2k
0 votes
1 answer
78 views

FLS Create Security Risk still appears even though object is checked if it is creatable

So I have this code: obj.field1__c = 'placeholder'; if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){ insert obj; } When I receive the (Checkmarx Source Scanner report), I still get ...
user avatar
-2 votes
1 answer
215 views

Access to account team member object

I have a custom profile and the assigned user is not able to see buttons 'Add Default Team', 'Add Team Members' etc. At the time of creating custom profile I had given only Read, Edit permissions on ...
user avatar
0 votes
1 answer
44 views

Salesforce Sharing settings for price book shows option as "Use". How its different form Public View and Public read write?

Salesforce Sharing settings for price book shows option as "No Access", "View Only" & "Use". How "Use" is different form "View only" and Public ...
user avatar
  • 8,980
0 votes
1 answer
877 views

gets “System.QueryException: Insufficient permissions: secure query included inaccessible field” error

We have a query that is executed by an “experience site/community” user. The user has “Partner Community” license and “Partner Community User” profile. This user executes code containing the following ...
user avatar
1 vote
1 answer
106 views

Does workbench store or cache data anywhere outside of Salesforce?

If you import a data file into workbench for querying or attempting to load into Salesforce, is it stored anywhere outside of Salesforce that may need to be purged?
user avatar
3 votes
1 answer
341 views

Workbench - CVE-2021-44228

This is relative to the CVE-2021-44228 log4J vulnerability. Is anyone aware as to the impact on Workbench? A POC for Salesforce support said it was impacted. If so - would anyone know how it ...
user avatar
1 vote
1 answer
364 views

WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL

Premise: I followed WITH SECURITY_ENFORCED, Security.stripInaccessible and comparison before designing my Apex class for querrying a few records. Doubt: I implemented my SOQL as Security....
user avatar
  • 405
2 votes
1 answer
37 views

How to prevent other people to unsubscribe on behalf of the subscriber?

Is it possible for a person other than subscriber to unsubscribe for them. For instance, assuming subscriber receive a email with button to that redirect it to a cloudpage with unsubscribe link on it, ...
user avatar
1 vote
1 answer
270 views

How to exempt Automated Testing Users from MFA requirement?

We are in the process of turning on MFA. We have enabled it for the appropriate Profiles and it works fine for most users. We have a couple of automated testing users in the Profiles that have the ...
user avatar
0 votes
0 answers
14 views

Showing report charts in digital experiences/ communities to guest user

I'm trying to figure out how to display report charts to unauthenticated users in salesforce digital experiences. In a way that isn't going to compromise anything. Is this possible or do I need to ...
user avatar
0 votes
0 answers
49 views

MFA Multiple Verification Methods, change order of precedence

Salesforce has an order of precedence for verification methods when logging in with MFA: Salesforce Authenticator. Time-based one-time passcode (TOTP) authenticator apps. Built-in authenticators. ...
user avatar
1 vote
1 answer
48 views

Will record data be visible via API if shared using sharing records with Guest User on Communities?

We are setting up a public Communities page. This page will publish a flow to capture leads but the flow must have read access to Account and another custom object to do its job. Communities requires ...
user avatar
-3 votes
1 answer
110 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
user avatar
5 votes
1 answer
87 views

How to deal with the security of odd standard fields?

We are using the Security.stripInaccessible method to identify fields that don't have the proper DML permission to insert, update etc. It works good for the most part but it gives us some false ...
user avatar
0 votes
0 answers
159 views

Impact of "Enable clickjack protection for customer VisualForce pages with standard headers"

Can anyone tell me what could be the impact in Org if Admin enables session setting "Enable clickjack protection for customer VisualForce pages with standard headers" I totally understand ...
user avatar
-1 votes
2 answers
105 views

Best Practices for Storing API Key?

I have a Lightning Web Component that makes a fetch() request straight from the component's JavaScript. For testing and development I've simply stored the API key as a variable, but I'd like to back ...
user avatar
0 votes
1 answer
37 views

Is it ok to store a bearer token in a custom field in the user object [closed]

I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. ...
user avatar
5 votes
1 answer
95 views

Is there a security hole in Salesforce's documentation?

I was looking at Salesforce's documentation for implementing an OAuth callback and I noticed they are accepting a "sfdc_community_url" from the client, which should normally only ever be a ...
user avatar
0 votes
0 answers
46 views

Security in Cloudpages when using Java Script flow frame-work to call app and customer can input their details on that app called by Javascript

We are developing a cloudpage (Landing page) in marketing cloud and on that landingpage there is a button called "Get Started" so once customers land to this cloudpage they can click on &...
user avatar
  • 11
0 votes
2 answers
74 views

Salesforce Backup Process

I would like to be informed about Salesforce Backup Process (Security Management). I would like to know more about the Standard Recovery Process if any. How often is the Salesforce backup taken? ...
user avatar
0 votes
0 answers
64 views

Unable to disable XSS-Protection

I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
user avatar
  • 187
0 votes
0 answers
44 views

REST API. Sending sensitive data in URL . Security issue

I have a security issue. I built an app that interacts with WordPress and its plugins via REST api, gets and posts some info and syncs it with Salesforce data. I have apex classes that perform HTTP ...
user avatar
0 votes
1 answer
37 views

Can I view a record if that record type / page layout is not assigned to me in salesforce

If I have access to 2 record types of an object and someone who has an access to a 3rd record type assignes me that record (which was created using that 3rd record type), will I be able to view it?
user avatar
  • 15
0 votes
1 answer
92 views

Auth Provider configured as High Assurance continues to prompt users for MFA?

Our users currently log into our org using their salesforce username and password credentials along with their registered verification method of choice for Salesforce's own MFA prompt. We're now in ...
user avatar
  • 2,564
0 votes
2 answers
519 views

What is isCreatable and isUpdateable for FIELDS in GUI

Where can I find and enforce "CREATABLE" and "UPDATEABLE" options for fields? Because, i am able to check the permissions in Apex(below statements) whereas, not able to find what ...
user avatar
1 vote
0 answers
85 views

Can RSA SecurID be used as Salesforce MFA?

Next year MFA will be required (Salesforce MFA Doc) and the customer has RSA SecurID as 2FA for other applications, We would like to know if we can use SecurID as a third-party authenticator app for ...
user avatar
0 votes
0 answers
20 views

How to provide CRUD permissions over groupmember object

For a non-admin user(Salesforce Platform license) with minimal/specific permissions, we want user to access groupmember record programmatically, for CRUD operations (especially Delete). However, while ...
user avatar
0 votes
0 answers
23 views

Salesforce implicit sharing - does access to account records via implicit sharing open up access to contact records as well?

If OWD is set to private and access to case record opens up the access to account Record via implicit sharing, will that also open up the read only access to contacts related to those accounts? ...
user avatar
0 votes
0 answers
8 views

Why can the member of a delegated group assign profiles not listed as assignable?

Two sandboxes are set up with the same assignable profiles in a delegated group under Delegated Administration. In one sandbox, users can only set up new users with one of the assignable profiles ...
user avatar
2 votes
1 answer
140 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error thrown in random places

Recently I've started getting error message: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Access to entity 'AIInsightValue'...
user avatar
2 votes
1 answer
73 views

Marketing Cloud SSL DIY Setup Cheaper?

I'm a marketing cloud and ssl newbie, so forgive this newb question. So, we have 2 business units with SAP needing 4 SSL Certificate, I contacted our account exec to get a quote. The total was ($6.5k) ...
user avatar
  • 75
0 votes
0 answers
21 views

Visual Force expose on External Site - Manage access

I have a need to create a visual force page that will be accessible on an external web site, it will be displayed in an Iframe. The page will be accessible only for specific web site user after login. ...
user avatar
  • 423

1
2 3 4 5
17