Questions tagged [security]
Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.
895
questions
-3
votes
0
answers
35
views
(urgent) Epic Games Player Support Security requires users to contact from their oldest devices in order to recover their accounts. How can I bypass? [closed]
This is a million dollar problem.
If your Epic Games account was hacked or inactivated, Epic Games has this security measure that requires users to contact Player Support using their oldest devices (...
2
votes
1
answer
52
views
What is the meaning of Type field on PermissionSet standard object in Salesforce?
Documentation page about permission set provides a limited information about Type field.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: Available in API version 46.0 and later....
- 16.1k
0
votes
0
answers
29
views
SSO using SAML - Error using Heroku App setting Up SAML
I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5
I setup SSO ...
- 4,761
-1
votes
0
answers
32
views
OAuth 2.0 verification
does anyone have Oauth 2.0 documentation that can help me verify if I have configured my integration correctly thank you!
- 1
0
votes
0
answers
17
views
How does the CampaignMember object work in terms of record visibility?
I am trying to understand how the CampaignMember object behaves in terms of security.
According to the Salesforce documentation, in order for a user to view a CampaignMember record the user must have ...
- 1
1
vote
0
answers
71
views
How does Permission Sets works against Licenses of Managed Package
We have built a Second Generation Managed Package and want it to be available as paid version in AppExchange Portal. So If a user buys it from AppExchange, he/she gets the licenses to use the solution....
- 69
1
vote
1
answer
160
views
Why is OAuth Client Credentials safer than OAuth Username-Password?
According to Salesforce, here
"You can use the username-password flow to authorize a client via a connected app that already has the user’s credentials. However, we recommend avoiding this flow ...
- 3,514
3
votes
1
answer
88
views
Enforce User Mode in Dynamic SOQL - String or Parameter?
Is it equally appropriate and safe to use each of those Dynamic SOQL calls with USER MODE or should I prepare one over the other? The official documentation doesn't make that clear.
User Mode as part ...
- 37.3k
-1
votes
1
answer
64
views
Does 'View all data' permission in salesforce give users access to private reports of another user? [closed]
Does 'View all data' permission in salesforce give users access to private reports of another user? Couldn't find any exact theory on this.
1
vote
1
answer
120
views
How to Resolve the Apex PMD Rule "ApexOpenRedirect"
community.
I am currently working on a custom plugin for an Auth Provider in Apex and have encountered the error message "Apex classes should safely redirect to a known location (rule: Security-...
- 33
0
votes
1
answer
43
views
Lookup query exception while using USER_MODE
I am trying to create a 2GP package. But whenever I try to create a version by running and validating all test classes and metadata, the test class fails and shows such an error.
"common.apex....
-1
votes
1
answer
48
views
Perform DML on Salesforce Object from non-salesforce user
I have a requirement to send an email to individuals who are neither Salesforce users nor community users. Within the email, there is a hyperlink, and when they click on it, I need to update the ...
0
votes
0
answers
79
views
Callout named credential calls with a blob body
I am trying to launch a callout call to an OCR from an Apex method using a secured named credential with an external credential.
The HTTP request is a POST request with multipart body containing a ...
0
votes
0
answers
120
views
Programmatically edit authentication parameter of external credentials
I was wondering if updating an authentication parameter of an External Credential was possible from an Apex method.
The main goal of this function would be to programmatically store an access token ...
2
votes
1
answer
69
views
Best Practices for CRUD/FLS/SHARING checks in unmanaged code
I'm auditing an ORGS unmanaged Apex and trying to form a concrete framework for when I care about PMD warning for ApexCRUDViolation & ApexSharingViolations.
It's always been my understanding that ...
- 10k
-1
votes
1
answer
55
views
Check if user have set security Question
Is there a soql that system admin can execute to list users who have set security question during their past logins?
Thanks,
- 89
-1
votes
1
answer
39
views
How to make an attached document to record visible only for the owner
How to make an attached document to record visible only for the owner of record (custom object) and not visible for other users (for wish record is visible)?
- 11
0
votes
1
answer
53
views
Do I need to check FLS for each field when creating a new object record in apex?
If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
- 41
0
votes
1
answer
20
views
How to detect Formula Expressions exposing vulnerable information like session id?
There is a snippet from the Salesforce Security Guide (Version 58.0)
Formula Tag heading explaining why it is a security vulnerability :
The general syntax of these tags is:{!FUNCTION()} or {!$OBJECT....
- 1,251
-1
votes
1
answer
178
views
Is WAF implemented for Salesforce APIs?
Our client's cybersecurity team is inquiring if Salesforce implements WAF (web application firewall) for its standard APIs.
We have a salesforce application using Sales, Service and Experience cloud.
...
- 4,185
0
votes
1
answer
44
views
Validate OWD, with sharing, Profile, Permission Sets as Non - ADMIN user
I am trying to validate the OWD for an object that is Public/Read Write without Read permission at the object level for a specific profile user. To validate the results I created a new profile by ...
- 111
2
votes
2
answers
165
views
Insecure Storage of Sensitive Data Vulnerability for a security review
We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ".
I am making a call to external service to get a encrypted claim that i am using to ...
- 3,406
0
votes
0
answers
41
views
Check whether generic SObject is updateable
How do I check whether a generic SObject is updateable before DML operation. For standard and custom objects I know the general pattern is:
Schema.sObjectType.Account.isUpdateable()
However if I have ...
- 41
1
vote
1
answer
258
views
Restrict access to specific fields when using Salesforce Integration User Licence on Standard objects (like Contacts)
By default, the Salesforce Integration User Licence doesn't provide access to a variety of standard objects (including Contacts and Accounts).
You can extend the access for an integration to those ...
-1
votes
2
answers
56
views
Data segregation for high confidentiality
I work at a bank and we currently use one single org to simplify our processes, but we have a department with highly confidential info.
I’m trying to find a way to “separate” the data from this ...
0
votes
0
answers
81
views
Only Create Access but edit and delete using permission set
I have an requirement that profile need to give creating the record but delete and edit access should be done by permission set.
In profile on FLS I gave read and edit acccess to all field or else we ...
- 3
0
votes
0
answers
428
views
Able to view the Account records even though OWD set to private and removed all permissions like view all & modify all
I have created the sharing rule to share ony specific record type record to shared with a group.
my object is Account and Org-Wide Defaults set to the Private, removed the permissions like view all &...
- 23
0
votes
0
answers
29
views
Granting Access to a Managed Package
We are developing a managed package that will be published. We want to control access to our application based on user LICENSE. However, we are unsure about the most effective method to achieve this.
...
0
votes
1
answer
142
views
OWD Sharing Settings and Account Sharing Rule
I'm unable to get this working in my companies Sandbox so I've spun up a brand new Developer Edition Org to see if I can replicate the issue. Being a brand new org there are no permission sets, ...
- 118
0
votes
0
answers
87
views
API endpoint - Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org
I didn't find any, maybe you can help.
I am looking for the API endpoint of Session Settings -> Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org.
I found ...
0
votes
0
answers
21
views
Access Permissions of Files -Salesforce and Share Point integration
We're exploring option to build integration between Salesforce and Share Point. We're looking into various options like File Connect or appExchange tools but we're getting stuck at one important point-...
- 493
2
votes
1
answer
479
views
Cannot Add Principal To Named Credential
I am trying to create a named credential with a principal using the instructions at this URL - Using API Keys with Named Credentials
But, in the "Store an API Key as an Authentication Parameter ...
- 577
0
votes
0
answers
108
views
Security Predicate for Community User
For a community user to see relevant records in community, what should be the security predicate if account owner id and related opportunity owner is owned by the logged in user?
I understand that
...
- 3,152
0
votes
1
answer
295
views
Salesforce External Credentials Custom Body
I was configuring external credentials in Salesforce, but I noticed, there's no Custom Body on it, is there any way to add it using OAuth 2.0 Authentication Protocol? I'm only seeing Custom Headers ...
1
vote
0
answers
45
views
Restrict field edit access
My org has OWD as Private for opportunities. I have a specific requirement where one user needs to be able to edit 3 custom fields in all opportunities , but not other fields should be editable. No ...
- 11
0
votes
0
answers
33
views
Setup Activity object security
I have a problem while setuping security for Activity object.
The problem is standart behaviour of OWD setting for Activity. Even If i set private records are shared to people who has Read access to ...
0
votes
1
answer
28
views
Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?
On one legacy project the following pattern was implemented.
Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
- 16.1k
0
votes
0
answers
46
views
Securing API access to Salesforce from a custom mobile app
Custom mobile application sends requests to a custom REST web service on Saleforce. The request contains an external ID, which is saved on the Contact standard object along with customer data. This ...
- 644
2
votes
2
answers
197
views
Guest Use Access Report Package AuraEnabled ApexClasses
This article was recently published and caught the eye of our leadership team:
https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/
The article recommends using ...
- 9,441
0
votes
0
answers
41
views
can we create sharing rule on contentdocumentlink object for share an files/image to guest user in experience cloud?
I am storing images in files and I want to get that images without authentication for guest users. So I want to create sharing rule on contentdocumentlink object and share records with guest users. So ...
0
votes
0
answers
84
views
How can I restrict the user from Editing the Account Site Field of account Object using profile settings?
I am facing some issue here regarding field level security in Profile
Sales Admin (Cloned From System Administrator)
Object Level Security (Standard object permission) Account Object | Only Read ...
0
votes
0
answers
29
views
Issue with Creating records thru flow with all access data in community portal
Current Config
Organization-wide setting -
Sharing Setting
Custom Object LeadStage -
External sharing - Public Read /Write
Community Portal Guest User Profile
Custom Object LeadStage - Create, Edit
...
- 1
-1
votes
1
answer
14k
views
Refused to display 'URL' in a frame because it set 'X-Frame-Options' to 'sameorigin'
Within the 'My Domain' settings - Authentication Configuration's I have added (as an example) https://www.salesforce.com/dreamforce/ to the Right Frame URL.
When I go to our sandbox login page, on ...
- 77
0
votes
0
answers
114
views
Secure LWC embedded on Experience Cloud
I have an experience Cloud site that uses a custom LWC component. This LWC component allows for editing specific contact fields for the logged in user. Profiles or permission sets aren’t used to ...
1
vote
1
answer
72
views
Site.login() URL is not working on production org
We have an Experience site with a custom Apex login controller.
When a user logs in, the controller captures the URL from the PageReference returned by Site.login() and sends the login URL to the user ...
- 449
0
votes
1
answer
154
views
How can I create a enhanced transaction security policy to allow only POST method in API event
I want to set some alerts and restrictions for API calls using Shield Event monitoring. I am not able to figure out how can I create real-time monitoring using Transaction security policy to allow ...
- 1
6
votes
3
answers
878
views
With USER_MODE - do we still need SOQL and DML libs?
As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
- 37.3k
7
votes
1
answer
3k
views
For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?
When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given ...
- 307
0
votes
1
answer
131
views
When is the External Service Scan required in Salesforce Security Review?
I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
- 685
-1
votes
1
answer
293
views
How to enable/disable button based on user edit access in LWC datatable?
I am building a Lightning Web Component (LWC) that retrieves data from Apex and displays it in a datatable. Currently, the LWC component retrieves all records from Apex, but I want to fetch that the ...
- 58