Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
13
votes
0answers
188 views

What is the impact of the Release Update: “Enable Secure Static Resources for Lightning Components”? (due 2020-11-29)

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To ...
1
vote
0answers
28 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
1answer
19 views

Why are Apex Class Permissions being enforced in sandbox but not in production?

In our full sandbox, our QA engineer has observed that one of our Lightning Components is failing. Upon further inspection, it turns out that the Apex class the component is calling is not accessible ...
0
votes
0answers
24 views

Keeping a ViewAllData permissionset viewing all fields

I have a permissionset which I want to grant broad read-only access to nearly all fields and objects. I've granted the permissionset the ViewAllData permission already, but that permission does not ...
0
votes
1answer
43 views

How to use variables in JavaScript without exposing them in the browser?

I want to use the Bee Template API inside my Visualforce page. So, this is the code I used: //Visualforce Page <apex:page showHeader="false" controller="...
0
votes
1answer
51 views

Is there some standardized way to ensure custom settings are not automatically cloned into Sandboxes?

Among other things, our custom settings include URLs for production servers and credentials to access those servers. Arguably, some of these things should probably be Named Credentials, but the ...
0
votes
1answer
26 views

Best way to limit visibility to Synchronized Data Extensions in Dev Org?

What is the best way to limit the visibility to Synchronized Data Extensions as well as their ability to view the Synchronized Data Sources & Objects in Marketing Cloud from other users? Do we use ...
0
votes
0answers
12 views

Approval Email Notification Template Is Not Triggered By All Users

I have created an Approval submission email notification template in Dev sandbox. This is working for all the users who ever submit the approval process, email is submitted to queue members/queue ...
3
votes
1answer
50 views

FLS check in 2GP

I've created a new 2GP package. Since it is going to be released to AppExchange, I've implemented a generic CRUD and FLS check for every place I contact with the Database in my Apex code. e.g. ...
1
vote
2answers
52 views

Does a library exist for securely querying for arbitrary data?

I'm looking for a library we can use from Aura and Lightning Web Components in particular, to take some sort of request and return the data for it, but only if/what the user can see. Per their secure ...
0
votes
1answer
21 views

Marketing Cloud Roles & Visibility, if allow and deny are not checked this means that it is not visible?

When setting up users in their respective roles, if the allow and deny boxes are not checked this means that the feature/capability is not visible to them correct?
0
votes
0answers
33 views

APEX PMD Security Error

Added Chrome PMD Extension Salesforce Advanced Code Searcher to run PMD script for my Apex Controller. Below Code doesn't shows any security error. if( Programs__c.SObjectType....
0
votes
0answers
33 views

PMD Apex ExcessiveClassLength & ExcessivePublicCount Rule error

Getting the following error message when I Ran the PMD scripts for Apex Class. ExcessiveClassLength -- Avoid really long classes. ExcessivePublicCount -- This class has a bunch of public methods and ...
0
votes
1answer
43 views

Default encryption for CloudPagesURL()

My client would like to know which encryption does CloudPagesURL() use to encrypt the parameters transferred to the Cloud pages. I am talking about the encryption used to transfer parameters to a ...
4
votes
2answers
136 views

PMD Apex ExcessiveParameterList Rule error

When I run the APEX PMD, getting Design Error for the Below method. ExcessiveParameterList Avoid long parameter lists. Checked below link not able to solve this issue, Can anyone please help me on ...
0
votes
0answers
16 views

What is the best sharing model for Category sharing of data

For My Application, I have to build a Category wise sharing, which means all data, objects related to Category A should be shared to a group of users and Category B should be not. So i have different ...
-1
votes
1answer
63 views

Apex Security rule Check of Soql/ DML [closed]

Trying to add Security Check on SOQL/ DML action in my Apex class. Gone through the following link https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/...
0
votes
0answers
38 views

How can I access a High Assurance Session in an Async Apex context?

Has anyone worked with a high assurance session requirement and async apex? I need to query the Security Health Check objects during an async process (the query happens in a queueable). If "View ...
0
votes
1answer
26 views

PMD Security - Apex Suggest Using Named Cred

Getting Suggest named credentials for authentication error in my PMD script. http http = new http(); httpRequest request = new httpRequest(); request.setMethod('POST'); request....
0
votes
1answer
15 views

Can we apply user-level security on the Javascript controller file and the helper file of a lightning component?

I have a lightning component with its associated javascript controller and helper. Now I have the requirement to make the javascript controller and the helper read-only. Can anyone give me an idea to ...
0
votes
0answers
26 views

Auditing on Report Access

There is a requirement to keep track on access provided to report(or folders). Also need to have a list of users who has access to which report(or folder). There is no direct way to get the list of ...
1
vote
1answer
37 views

Welcome Email not getting sent to community users on register

I have run into an issue where if I am unchecking a checkbox: 'Let guest users see other members of this community' under general setting in Preferences. If the check box is checked, welcome emails ...
0
votes
0answers
22 views

Salesforce mobile app - canvas app - pop up not working

I have a canvas app enable in a connected app. This canvas app is included in a visualforce page. The canvas app points to a web app hosted elsewhere. The web app authenticates its users by opening up ...
0
votes
2answers
60 views

PMD Security error - Apex Suggest Using Named Cred

I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code. Blob headerValue = Blob.valueOf(username + ':' + password); String authorizationHeader = '...
0
votes
0answers
46 views

stripinaccessible stripping fields for system administrator

I have a generic function to validate CRUD before DML which uses stripInaccessible(). public static SObjectAccessDecision validateCRUD(AccessType access, List<SObject> records, Boolean ...
3
votes
2answers
83 views

Tightening security around Javascript Remoting from Visualforce

We have a community portal built off of Visualforce pages and on those pages we do a lot of Javascript Remoting. Due to the complexity of our org, most of the Apex classes holding these remote methods ...
2
votes
1answer
41 views

Using isSet() vs getRemovedFields() to identify inaccessible fields after stripInaccessible()

I am wondering is there a difference between isSet() and getRemovedFields() to identify inaccessible fields that were removed by the stripInaccessible() method. From the official documentation Enforce ...
0
votes
0answers
17 views

Help with records not displaying on Force.com site

I've been building a Salesforce Site but am having trouble getting records to display on the page. I am using a specific Visualforce page as the homepage and can get the records to display fine when I ...
1
vote
1answer
72 views

use post requests for cross-domain sessions - session setting

I have enabled this session setting in my sandbox org. I did not see any difference interms of impacts to my system.which areas it will affect our system What i need to test before moving it to the ...
0
votes
0answers
15 views

How to share parent records with a community user

When I create junction object with two parent objects I need to share parent record of this junction record with community user. How can I achieve this without Apex Share which enabled for Customer ...
1
vote
1answer
44 views

Summer 20 Release Guest Site - allow create custom object

We have a force.com site that has numerous VF pages to create a custom object. The Summer 20 release report says that we need to / will be forced to shut down access. I see that one can create sharing ...
2
votes
1answer
140 views

What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent?

This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present ...
2
votes
0answers
89 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
2
votes
2answers
151 views

Inherited Sharing not respected in trigger context

I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
1
vote
1answer
31 views

How quickly are updates to Custom Metadata Types committed?

In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/...
0
votes
1answer
37 views

Lock a Field on a Record based off of Profile

I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
0
votes
0answers
22 views

Set-up a File Location that is not on a standard port

According to documentation Marketing Cloud will only allow connections on the stardard 21/22 ports. The client has a security policy that doesn't allow access to standard ports. https://help....
3
votes
2answers
620 views

What is the impact of enabling the critical update 'Route My Domains Through Salesforce Edge'?

Based on the documentation, it'll use Machine Learning to improve connectivity and performance --> so is this going to switch Salesforce login by default to Edge?
2
votes
0answers
19 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
0
votes
0answers
45 views

Custom Setting vs. Custom Object vs. Custom Metadata Type for Multiple Environment Credentials [duplicate]

I am looking to confirm the best practice of storing client / secret credentials for multiple environments for multiple external webservices within salesforce. Below is the analysis I have done ...
0
votes
0answers
156 views

Install for “All Users” vs “Admin Only” (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
0
votes
2answers
32 views

How can I find the Secure URL for the public site by Apex?

We are using the following code to find the Secure URL for the public site by Apex List<String> siteFullUrlList = new List<String>(); List<Site> siteList = [ ...
0
votes
1answer
69 views

“https://sforgcompare.herokuapp.com/”Is this trusted tool for Salesforce org comparing sandbox to sandbox and sandbox to production [closed]

"https://sforgcompare.herokuapp.com/" is this trusted tool, any other tools for org comparing in Salesforce. Your comments/suggestions would be greatly appreciated. Thank you
0
votes
1answer
23 views

Open Page Redirect Issue

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. Id id = ...
0
votes
0answers
30 views

Embedded Chat PreChat Form

I am using the Salesforce embedded chat functionality in a customer community. For security purpose, I don't want users to be able to change their name and email address when using the chat ...
0
votes
0answers
146 views

Auth Provider with per-user Named Credential

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
0
votes
1answer
63 views

How to pass Id in a encrypted format to public site in Salesforce?

I have created a public site where a VF page is exposed with a few URL parameter ( Id of a few objects ). Now I want to encrypt those Ids so that there is no security risk. I was trying to achieve it ...
1
vote
1answer
64 views

Auditing changes made by an admin on behalf of another user

I am wondering whether we have an option/ functionality in Salesforce to store the details of the user who logs as a different user. Use Case I am a System Admin (User X) to a Salesforce instance ...
0
votes
1answer
290 views

CheckMarx FLS Create/Update Vulnerability in Salesforce Apex Code [duplicate]

I need help in fixing below vulnerabilities found in CheckMarx scan. Scenario: I have written a trigger on FeedItem object. This trigger will archive the FeedItem into custom object ...
0
votes
1answer
55 views

Salesforce Data Mask and Workflows / Process Builder deactivation

I'm trying out Salesforce's Data Mask feature and in the docs (https://help.salesforce.com/articleView?id=data_mask_considerations.htm&type=5) it mentions that all workflows (and presumably ...

1
2 3 4 5
15