Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
1answer
10 views

Debugging best practices - callouts and security risks

What is the best practice for debugging callouts and their endpoints that are stored in custom metadata or custom settings? What are the possible threats and security risks if adding this sensitive ...
1
vote
1answer
15 views

XML format for IP Ranges in Security Settings

I'm trying to use sfdx for source based development. Trying to define the range of whitelisted IPs in Security.settings-meta.xml. When I push my code to my org I get an error: Error force-app/main/...
0
votes
1answer
23 views

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects? Can I check the above using AuthSession object's ...
0
votes
0answers
26 views

Chrome states “Not Secure” when on record page with Lighting Web Components

When I navigate to a record with a Lightning Web Component, my chrome browser lists "Not Secure" in the hyperlink bar. How do I configure either the Salesforce instance or my Lightning Web Components ...
0
votes
1answer
19 views

there an easy way to so a soql query to see the the applications a profile has access to?

I tried this query recently SELECT Id, Name FROM AppMenuItem WHERE Id IN (SELECT SetupEntityId From SetupEntityAccess WHERE Parent.ProfileId =: id) ORDER BY Label and got this error The selected ...
1
vote
0answers
22 views

Authentication via SFDC to “Approve” a record - Secure method needed [closed]

I have a unique requirement to build and am having trouble with the method to use to meet it. Working with a science lab that wants the ability to soft lock a record (via Validation Rule) that ...
0
votes
0answers
21 views

How to disable Settings link?

I am looking for disable the "Settings" option displayed in salesforce when clicking in the user circle for specific profiles. Thank you all!
8
votes
1answer
126 views

Can API access be limited to only via Apex classes?

We are building a product that offers two routes to the back-end data: JSON calls to @RestResource Apex class APIs LWC calls to @AuraEnabled Apex classes Is there a profile setup that keeps these ...
0
votes
1answer
22 views

Permision control of Notes and Attchments

How can we control the CREATE/READ/EDIT/DELETE permission of Notes and Attachments via Profile/Permission set? Is the permission of Notes and Attachments govern by the parent object like Account, ...
5
votes
1answer
36 views

Security stripInaccessible's SObjectAccessDecision getRecords() ordering

Is there a guarantee documented anywhere that the ordering of the SObjectAccessDescision's getRecords() method will match the ordering of the input list? It seems to be the behavior but I can't see ...
0
votes
0answers
17 views

Export Email Whitelisting in SFMC

I have a question about Export Email Whitelisting in Marketing Cloud. I have read the documentation but it's not clear on this particular matter. If I want to enable Export Email Whitelisting in one ...
2
votes
0answers
31 views

Guest User Create and Update permission after Spring '20

During Spring '20 Salesforce is deploying a set of security updates regarding the Guest User profile and its capabilities, mainly limiting it from being able to create and update records. We have ...
0
votes
1answer
15 views

Grant Access Using Hierarchies

If the OWD of a custom object is Private and Grant Access Using Hierarchy is enabled, then whether the user in the higher hierarchy always has the edit, read, delete access on the records which is ...
0
votes
1answer
16 views

JUNCTION OBJECT OWD if it masters has different OWD

User has Create,Edit access b ParentA, Read access on ParentB. OWD on parent1 is Public write/Read Owd on ParentB is Public Wirte/Read Now I got the sharing access on Junction object is Edit Acces.
0
votes
1answer
111 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
2
votes
0answers
21 views

How to enable CORS in a community

Hi i've recently encountered a problem where i needed CORS to be enabled for some domains. In the Salesforce Org i can specify CORS to be enabled for some domains. The problem lies with community ...
2
votes
1answer
22 views

Field History Tracking - control access to history?

re: the Field History Tracking feature, which you can turn on for specific objects and then specific fields within those objects: Is there any way to control access to the Field History? Apart from ...
2
votes
1answer
166 views

Secure Guest Users' Org-Wide Defaults and Sharing Model update

We are using force dot com site and on the first-page customer register them as a lead and there is no authentication anyone having that link and create a lead. If salesforce it says created by guest ...
1
vote
0answers
63 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY after Guest User Security Update

This month salesforce is rolling out a new security updated that prevents public sharing of record data, except via Sharing Rules that only provide Read-Only access. In preparing for this shift, I ...
3
votes
2answers
73 views

Shortest and most efficient way to query ALL accessible fields of an object

Now that stripInaccessible() and WITH_SECURITY_ENFORCED are GA I wonder what is the most readable and efficient way to do a SELECT all_accessible_fields_for_user FROM AnyObject WHERE Id = ...
1
vote
0answers
28 views

Need more than 50 Sharing Rules - now what?

The Requirement: Our organisation works in ~30 countries and has 6 groupings of workers ("Core Competencies") within each country. We have a number of Objects with OWD = Private and we need to ...
7
votes
1answer
106 views

What exception does Security.stripInaccessible throw?

This new security method Security.stripInaccessible both strips out fields that the user has no rights to and will throw an exception if the object-level permissions are being violated. What ...
0
votes
0answers
17 views

Issues adding add-on ICE from Mixable, Inc

I tried to add the ICE add-on to an app and it fails consistently with internal server error. Here from the CLI (sample name foo below): heroku addons:create ice:test -a foo Creating ice:test on ⬢ ...
3
votes
2answers
131 views

Does with sharing enforce OLS/FLS?

I am really confused about this one. I have done my share of research. In the documentation, it has been mentioned that with sharing keyword is used to enforce sharing rules for the current user. It ...
1
vote
1answer
35 views

How should I share a summary-level view of opportunities without sharing their activities, emails & files?

I have an org containing several business subsidies working on opportunities. These opportunities may have sensitive data attached to them in files, emails, calls, etc. Users in each subsidy should ...
2
votes
2answers
59 views

Cross-reference Permission label to permissionsXXX API Name

So, I'm running the SFDC Labs app Guest User Access Report that outlines what permissions a Community Guest User has The report enumerates permissions where the guest user has potential risk given ...
1
vote
0answers
84 views

Scan uploaded files for viruses

I have a public Salesforce Community that I use like Web To Case - for clients to create new cases in my org. For implementing that, I have developed a lightning web component that creates a case. ...
5
votes
0answers
58 views

Add Community members via Apex?

Is it possible to add/change/delete Community members using Apex? I know how to do this via the UI (see picture below), but I'm looking to automate some things on the demo side of the business for ...
2
votes
2answers
33 views

Remove installed package objects permission from Profile

Is there any easy way to remove Read, Create, Edit, Delete, View All, Modify All permissions of objects related to installed packages from Profile?. I have been doing this manually by going ...
0
votes
0answers
28 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
0answers
22 views

Lightning Knowledge external access

I'd like to have publicly available Knowledge base inside my partner community. What is already done: Created Partner Community Enabled guest access to the community Enabled Lightning Knowledge and ...
0
votes
0answers
18 views

Salesforce Administrator without files access

I have a unique scenario where there would be a user who should have admin permissions in an org but should not have access to files and attachments on records. Any way this could be achieved? Bonus ...
1
vote
1answer
66 views

Cant able to deactivate the user and not able to change the user license

Error: This user, as the Automated Case User, must have the "Modify All Data" and "Send Email" permissions. Select a profile or assign a permission set with these permissions enabled.
0
votes
1answer
35 views

validate callout payload at webservice? [closed]

I am making a callout to web service. How can i validate payload received from callout at web service endpoint. is there anyway to authenticate that request actually came from salesforce only?
5
votes
1answer
134 views

Marketing Cloud - callout from CloudPage to MC API - where to store credentials

We are building a simple functionality on a CloudPage that will be making an API call to Marketing Clouds API. I was looking at documentation to find information on where we should store the Client Id ...
2
votes
1answer
37 views

Field level Security Or Profile permission edit not working!

On a "section" of the Opportunity Object I am trying to give "read only" to a specific profiles or specific user however when I go to profile I am unable to edit profile permission of the object I am ...
1
vote
0answers
23 views

Providing a list of data to non-users securely [closed]

We have a requirement to send data to a list of people who are not users. This data is, and should be treated as, highly secure. These people are owed this data and are allowed to view it but it ...
2
votes
1answer
291 views

Constructing a SSL certificate chain for uploading to Certificate and Key Management [closed]

Background I generated a CSR from Salesforce setup and have received back the PositiveSSL Certificate from sectigo.com. But when I try and upload the certificate into Salesforce, I get this error: ...
0
votes
1answer
37 views

Community Plus users are not able to get the attachment using standard salesforce API

We want to get attachment BLOB data using the standard salesforce API. See the API Docs link below. ([https://developer.salesforce.com/docs/api-explorer/sobject/Attachment/get-attachment-id]) We are ...
2
votes
0answers
28 views

Schema.sObjectType.Task.fields.Subject.isUpdateable() is false in force.com site

We have managed a package where we are using apexrest through force.com site to update the task records. This works fine unless we add security enforce through apex getDescribe() like, Schema....
0
votes
1answer
20 views

Different QuoteDocument using Connected APP REST API and Workbench / Interaction

I've set up a autolaunched Flow, which creates a PDF based on a Quote Template. My connected APP use this Flow through the REST-API. The output is an empty PDF with a Size of 2 KB. The same Flow, ...
0
votes
1answer
25 views

can you restrict edit access to a field after one time edited?

I am working on a Picklist requirement which needs to give Edit access to all by default. Once any value is entered by any user, edit access is restricted to all except Admin Profiles. Any ...
0
votes
1answer
19 views

Make a User only view and manage users in setup - Nothing else

Is there a way - setting to say that a user will only manage users (view, create and update users) from setup and nothing else? For example, i don't want this user to have access to object manager ...
0
votes
1answer
9 views

Limit records based upon multiple criteria on object and user

I'm looking at limiting access to certain records such that should a record be assigned to a certain group of users (via some field on the object), only those users would be able see or edit those ...
1
vote
1answer
37 views

Field Level Security on Email Template Not Working as Expected

I'm trying to hide specific fields in an email template for a specific profile. For this, I removed the field level access for fields I want to hide for the respective profile. After logging in as ...
2
votes
1answer
132 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
0
votes
0answers
15 views

owner change in case with child record relationship master detail

I am changing the owner of the case and I have a master-detail with viewed notification object.everything is working fine .the problem is in changing the owner of the case does not transfer the viewed ...
0
votes
3answers
65 views

Possible to Detect if a Record is Being Created by Apex?

Background An Apex Trigger has been set up on a parent object to automatically create a child object record when the parent object record is created. However, another Apex Trigger has been set up on ...
0
votes
0answers
29 views

Access Granted Through Sharing Rules is Inconsistent - Keep Having to Recalculate

We're having a problem where we are continuously having to manually recalculate sharing rules in an org. Account OWD is set to Private. Sharing Rule 1: Account lookup field is populated by a certain ...
0
votes
0answers
11 views

Using PKCE while integrating salesforce with an authorization server [duplicate]

I want to authenticate users for salesforce community with external authentication server. I want to use PKCE to secure this. Has anyone implemented this? How to create code_verifier and ...

1
2 3 4 5
14