Questions tagged [security]
Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.
918
questions
0
votes
0
answers
31
views
Public experience site and safe-calling Apex without Sharing
my company security department has concerns about the Experience Page with Screen Flow and Apex without sharing class, and I am looking whether a different approach is possible.
Domain
Experience Page ...
- 61
-1
votes
0
answers
25
views
Apex REST Resource IP Ranges on Sites
If an Apex Class is exposed as a REST Resource (using annotation @RestResource) and that Class is enabled for access by the Public Access Profile associated with a Site then, provided the Site's ...
- 190
1
vote
0
answers
35
views
Enforcing Field security in Apex - Schema.objectType.sobject_name.fields.field_name VS sobject_name.field_name.getDescribe() VS stripInaccessible()
Currently, there are at least four ways I am aware of to check/enforce Field Access while running Apex:
Calling sobject_name.field_name.getDescribe().isUpdateable();
Example: Account.Description....
- 61
2
votes
0
answers
20
views
Images or content documents are broken in both Chatter and Apex Page when Cross-Origin Embedder Policy (COEP) is enabled
When turning on COEP, content documents show up as broken in both Chatter and my apex pages that display them.
The error I am receiving is
Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE....
1
vote
1
answer
114
views
How does static resources help prevent security vulnerabilities?
If I want to use a third party utility library, it's advised to load it from Static resource into LWC/VF page instead of directly loading it in the LWC as per this guideline document
Is there anything ...
- 2,655
-1
votes
1
answer
32
views
Making opportunities visible based off of business account owner
We are currently updating our opportunity visibility we would like the visibility to follow the below parameters:
1.They own the oppo (edit access)
2.They own the account related to that oppo (view ...
0
votes
1
answer
44
views
how can we handle fixed width and fixed height, float or position: absolute or fixed in aura components in security review
.THIS .slds-docked-composer{
float : right !important;
}
.THIS .messageInput {
height : 380px !important;
width : 320px !important;
}
How can we avoid using of fixed height and fixed ...
0
votes
1
answer
42
views
External callouts from Salesforce to third-party services that mandate IP restrictions
We make external callouts from Salesforce to a third-party - let's call them XYZ for this discussion.
We currently use MuleSoft for for this integration - there's a Salesforce experience API and an ...
- 101
0
votes
1
answer
75
views
How to set rules in vscode salesforce security scanner
I'd like to be able to set what rules run when running the Salesforce Security Scanner from within VSCode. There are times when I'm solely interested in security issues and I want to filter out noise,...
- 488
2
votes
2
answers
65
views
Is this an expected functionality in LWS? (LWS and window.top)
Are these results expected when executing the code block below in the LWS Console?
const a = 't',b='o',c='p'; const full = `${a}${b}${c}`;
const t = 'top' in window && window.top;
const t0 = '...
1
vote
0
answers
53
views
ZAP Scan: Apex callout to our backend API
I am in the process of preparing materials for our security review submission. I have a case where our Apex code calls out to our backend API:
Directly from Apex code
Background job: Schedule, ...
- 105
0
votes
1
answer
155
views
Why am I able to see a lookup record's name field if I don't have access to the record
I have an Object A and that has a look up to an Object B. There is a record A1 in Object A and there is a record B1 in Object B. Record B1 is a lookup on A1. The user has access to record A1, but does ...
- 1
0
votes
2
answers
110
views
How to hide EmailMessage from shared users?
Say I have an Account that I share with user A and B.
If user A sends email message, I don't want user B to see it.
So far I found Email Messages appear as Task object. TaskShare object doesn't seem ...
- 4,165
1
vote
0
answers
83
views
Domain Whitelisting AWS-based Appliciation in Hyperforce
Is there a way to whitelist a list of domains instead of IP Addresses in Salesforce after Hyperforce migration similar to allowlisting introduced here documentation but for incoming applications?
We ...
- 95
0
votes
1
answer
62
views
Manage package security review issue: Insecure Storage of Sensitive Data
My application is currently undergoing security review and has been reported with the 'Insecure Storage of Sensitive Data' issue, cause I'm storing the auth credentials in custom Object to enable ...
0
votes
1
answer
81
views
Using a Custom Object or Standard Object to expose data for integration
I have a requirement to integrate with a 3rd party application for Account data (Account creation). The idea is that Salesforce will be the primary source of truth and the other application will be ...
- 101
-2
votes
1
answer
189
views
how to secure sfmc cloud pages from external scripts attack?
When it comes to the security of the cloupages. How can we prevent the external scripts running on the cloud pages and secure our cloud pages from RXSS attacks on the smart capture form fields on the ...
- 17
1
vote
1
answer
117
views
How to establish API connection to a Trial Enterprise Edition org?
I have an enterprise edition free org. This has API access as I have connected to it over Postman via a connected app that I created. The problem I'm facing is that I want to connect to this org over ...
- 335
0
votes
1
answer
123
views
CSRF Fix not working in LWC
Below is a dummy LWC component to update a Custom Object record field (Year__c) value.
Dummylwc.html
<template>
<lightning-modal-header label="ANTI-CSRF TEST COMPONENT"><...
- 819
0
votes
1
answer
82
views
Security review failed due to debug lines
So the salesforce security review of my mannaged package failed due to data in log lines they have stated the below:
Issue Description
Revealing information in debug statements can help reveal ...
- 67
-1
votes
1
answer
22
views
Can I restrict a user with Role 'A' to view cases only with the status (picklist) values : new and open
Case object : private owd
Role :A
User with Role A should only be able to see the cases with status picklist values: new and open.
How can I do this? Is it even possible to restrict users access on ...
1
vote
1
answer
144
views
Question about Endpoint scanning (ZAP) for security review
As part of the Salesforce security review they state:
If your solution connects to any non-Salesforce domains, also run Chimera, ZAP, or Burp Suite on the external endpoints. Include reports from your ...
- 67
0
votes
0
answers
46
views
OWD and Profile Security Settings
I am facing an issue.
2 Custom objects Job(master) and Candidate (child).
Job - parent (OWD private) (Custom Profile permission - Read permission only)
Candidate - Child (OWD Controlled by parent) (...
1
vote
2
answers
347
views
LWC component throws error during loadScript for static resource - Lightning Web Security: Cannot access fullscreenEnabled
Have an LWC component that loads the @carbon/charts UMD bundle which is in force-app/main/default/staticresources/carboncharts. The renderedCallback() is throwing this error:
[Lightning Web Security: ...
- 767
0
votes
0
answers
73
views
OWD vs Role hierarchy on Activities
I have a problem with setting up data security as per client's needs. What I want is for any user to have access to any Task regardless they are the owner or not of the task or the account or contact (...
0
votes
1
answer
21
views
Is there are way to split users permissions between
Is this possible to control which users have access to which dialogs in one Einstein Bot?
Is this possible to control which users have access to which bots?
This article https://help.salesforce.com/s/...
- 17.4k
2
votes
1
answer
362
views
SOQL query 'WITH USER_MODE' then update
I fetch ObjectA records with a SOQL query 'WITH USER_MODE'.
Then I modify those records and want to update them in user mode
I am not sure if the previous 'WITH USER_MODE' command is enough to prevent ...
- 21
0
votes
0
answers
80
views
How to Create/Insert a new record of the objects AccountAccountRelation and PartyRoleRelation?
these 2 objects AccountAccountRelation and PartyRoleRelation have been added to our project recently and I don't know why I cannot create a record of these objects.
When I want to set the value of a ...
- 151
0
votes
0
answers
45
views
Site.login method invalid password issue
I have to develop custom login page in a LWR community.
I configured maximum wrong login attempts number in the Customer Profile, but I've recently found that Site.login does not increase number of ...
- 340
0
votes
1
answer
52
views
I want control the visiblity of record by Apex Manage sharing
I am trying to implement a solution of Account and contact, I have custom field Account status (Picklist field) values - Open, Close
My condition is when the Account status is moved to "Open&...
- 13
1
vote
2
answers
207
views
Apex Security in Salesforce
I have a question regarding Apex class security. I am new to coding so have some questions. My question : Whats the importance of using 'Enabled Apex Class Access' option through profile or class list?...
- 11
2
votes
1
answer
79
views
Storing Sensitive Information in ISV App
In our managed package, we have a lightning page where the app admin can set a couple of settings related to the app, including an API key to interact with 3rd party system, and all this information ...
- 73
-1
votes
1
answer
32
views
Is it a security vulnerabity to pass all field values of a record to a user
I created a Apex class that returns every field of a context record into any flow. The program works with any sObject.
Are there any security vulnerabilities by doing this? Should I prevent fields ...
- 31
1
vote
1
answer
447
views
How to restrict users accessing the Custom Metadata Type Record?
We are building a application which required a Public Custom Metadata Type. We have a Screen flow which has an LWC Component which calls an Aura Enabled Method of a public with sharing class. In this ...
- 143
0
votes
0
answers
36
views
Security Issue While Rendering Rich Text in Visualforce Page [duplicate]
I am trying to render a rich text content in a Visualforce Page like so :
<apex:outputText styleClass="richText" value="{!richTextContent}" escape="false"/>
...
- 73
2
votes
1
answer
165
views
What is the meaning of Type field on PermissionSet standard object in Salesforce?
Documentation page about permission set provides a limited information about Type field.
Type: reference
Properties: Filter, Group, Nillable, Sort
Description: Available in API version 46.0 and later....
- 17.4k
1
vote
1
answer
221
views
SSO using SAML - Error using Heroku App setting Up SAML
I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5
I setup SSO ...
- 4,839
0
votes
1
answer
526
views
How does the CampaignMember object work in terms of record visibility?
I am trying to understand how the CampaignMember object behaves in terms of security.
According to the Salesforce documentation, in order for a user to view a CampaignMember record the user must have ...
- 31
2
votes
0
answers
154
views
How does Permission Sets works against Licenses of Managed Package
We have built a Second Generation Managed Package and want it to be available as paid version in AppExchange Portal. So If a user buys it from AppExchange, he/she gets the licenses to use the solution....
- 143
1
vote
1
answer
1k
views
Why is OAuth Client Credentials safer than OAuth Username-Password?
According to Salesforce, here
"You can use the username-password flow to authorize a client via a connected app that already has the user’s credentials. However, we recommend avoiding this flow ...
- 3,726
3
votes
1
answer
156
views
Enforce User Mode in Dynamic SOQL - String or Parameter?
Is it equally appropriate and safe to use each of those Dynamic SOQL calls with USER MODE or should I prepare one over the other? The official documentation doesn't make that clear.
User Mode as part ...
- 38k
-1
votes
1
answer
674
views
Does 'View all data' permission in salesforce give users access to private reports of another user? [closed]
Does 'View all data' permission in salesforce give users access to private reports of another user? Couldn't find any exact theory on this.
1
vote
1
answer
820
views
How to Resolve the Apex PMD Rule "ApexOpenRedirect"
community.
I am currently working on a custom plugin for an Auth Provider in Apex and have encountered the error message "Apex classes should safely redirect to a known location (rule: Security-...
- 33
0
votes
1
answer
191
views
Lookup query exception while using USER_MODE
I am trying to create a 2GP package. But whenever I try to create a version by running and validating all test classes and metadata, the test class fails and shows such an error.
"common.apex....
-1
votes
1
answer
75
views
Perform DML on Salesforce Object from non-salesforce user
I have a requirement to send an email to individuals who are neither Salesforce users nor community users. Within the email, there is a hyperlink, and when they click on it, I need to update the ...
- 11
0
votes
0
answers
161
views
Callout named credential calls with a blob body
I am trying to launch a callout call to an OCR from an Apex method using a secured named credential with an external credential.
The HTTP request is a POST request with multipart body containing a ...
- 111
1
vote
1
answer
704
views
Programmatically edit authentication parameter of external credentials
I was wondering if updating an authentication parameter of an External Credential was possible from an Apex method.
The main goal of this function would be to programmatically store an access token ...
- 111
2
votes
1
answer
270
views
Best Practices for CRUD/FLS/SHARING checks in unmanaged code
I'm auditing an ORGS unmanaged Apex and trying to form a concrete framework for when I care about PMD warning for ApexCRUDViolation & ApexSharingViolations.
It's always been my understanding that ...
- 10.2k
-1
votes
1
answer
195
views
Check if user have set security Question
Is there a soql that system admin can execute to list users who have set security question during their past logins?
Thanks,
- 129
-1
votes
1
answer
126
views
How to make an attached document to record visible only for the owner
How to make an attached document to record visible only for the owner of record (custom object) and not visible for other users (for wish record is visible)?
- 11