Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Functionality Embedded Login explained

Salesforce provides the Embedded Login fuctionality which is pretty OK for some scenarios. But the issue is that it relates to user Third-Party Cookies, which will be restricted more and more in the ...
0
votes
0answers
14 views

How to share parent records with a community user

When I create junction object with two parent objects I need to share parent record of this junction record with community user. How can I achieve this without Apex Share which enabled for Customer ...
1
vote
1answer
31 views

Summer 20 Release Guest Site - allow create custom object

We have a force.com site that has numerous VF pages to create a custom object. The Summer 20 release report says that we need to / will be forced to shut down access. I see that one can create sharing ...
1
vote
0answers
56 views

What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent? [closed]

This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present ...
2
votes
0answers
79 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
2
votes
2answers
127 views

Inherited Sharing not respected in trigger context

I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
1
vote
1answer
29 views

How quickly are updates to Custom Metadata Types committed?

In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/...
0
votes
1answer
27 views

Lock a Field on a Record based off of Profile

I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
0
votes
0answers
22 views

Set-up a File Location that is not on a standard port

According to documentation Marketing Cloud will only allow connections on the stardard 21/22 ports. The client has a security policy that doesn't allow access to standard ports. https://help....
2
votes
2answers
226 views

What is the impact of enabling the critical update 'Route My Domains Through Salesforce Edge'?

Based on the documentation, it'll use Machine Learning to improve connectivity and performance --> so is this going to switch Salesforce login by default to Edge?
2
votes
0answers
18 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
0
votes
0answers
30 views

Custom Setting vs. Custom Object vs. Custom Metadata Type for Multiple Environment Credentials [duplicate]

I am looking to confirm the best practice of storing client / secret credentials for multiple environments for multiple external webservices within salesforce. Below is the analysis I have done ...
0
votes
0answers
41 views

Install for “All Users” vs “Admin Only” (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
0
votes
2answers
22 views

How can I find the Secure URL for the public site by Apex?

We are using the following code to find the Secure URL for the public site by Apex List<String> siteFullUrlList = new List<String>(); List<Site> siteList = [ ...
0
votes
1answer
39 views

“https://sforgcompare.herokuapp.com/”Is this trusted tool for Salesforce org comparing sandbox to sandbox and sandbox to production [closed]

"https://sforgcompare.herokuapp.com/" is this trusted tool, any other tools for org comparing in Salesforce. Your comments/suggestions would be greatly appreciated. Thank you
0
votes
1answer
20 views

Open Page Redirect Issue

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. Id id = ...
0
votes
0answers
21 views

Embedded Chat PreChat Form

I am using the Salesforce embedded chat functionality in a customer community. For security purpose, I don't want users to be able to change their name and email address when using the chat ...
0
votes
0answers
72 views

Auth Provider with per-user Named Credential

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
0
votes
1answer
45 views

How to pass Id in a encrypted format to public site in Salesforce?

I have created a public site where a VF page is exposed with a few URL parameter ( Id of a few objects ). Now I want to encrypt those Ids so that there is no security risk. I was trying to achieve it ...
1
vote
1answer
41 views

Auditing changes made by an admin on behalf of another user

I am wondering whether we have an option/ functionality in Salesforce to store the details of the user who logs as a different user. Use Case I am a System Admin (User X) to a Salesforce instance ...
0
votes
1answer
86 views

CheckMarx FLS Create/Update Vulnerability in Salesforce Apex Code [duplicate]

I need help in fixing below vulnerabilities found in CheckMarx scan. Scenario: I have written a trigger on FeedItem object. This trigger will archive the FeedItem into custom object ...
0
votes
1answer
37 views

Salesforce Data Mask and Workflows / Process Builder deactivation

I'm trying out Salesforce's Data Mask feature and in the docs (https://help.salesforce.com/articleView?id=data_mask_considerations.htm&type=5) it mentions that all workflows (and presumably ...
3
votes
0answers
71 views

Apex Row-Level Security is not applied to OwnerId field

It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement. public with sharing class ...
1
vote
1answer
30 views

Authentication Vulnerability Issue with Page Redirect

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. public Pagereference ...
0
votes
1answer
45 views

How to store OAuth credentials in Salesforce Securely [closed]

I have implemented a custom auth provider by following the steps from this help guide https://help.salesforce.com/articleView?id=sso_provider_plugin_custom.htm and the setup works as expected. Now ...
0
votes
0answers
11 views

How to create and manage session for sites for force.com in Salesforce

We have created a portal to login to the sites for the customer. We are managing the credential(username and password) on the third party website. When I open this link anywhere it shows that the ...
4
votes
1answer
240 views

How to troubleshoot Exception thrown when using WITH SECURITY_ENFORCED

I've added the WITH SECURITY_ENFORCED clause to my SOQL queries. I'm testing them with a user who has a permission set that grants all object permissions (read, create, etc.), and also has read and ...
-1
votes
1answer
30 views

Apex FLS Methods

I have a question regarding Salesforce FLS. Is there any method available which dynamic check the object field-level security. Like I have Account object and Field name Phone and pass to any ...
0
votes
0answers
15 views

Bad Field Names on Insert Update in Integration (but not on all records in transaction)

Scenario We have an integration that upserts records against Sobject A, C and CO. (I'm using letters to represent for brevity) A - Account C - Contact CO - CustomSobject (junction Sobject between A &...
0
votes
1answer
18 views

How can I allow a profile to only have access to user creation and nothing else

I have cloned a read only profile and removed all access except manage users. I am still able to see custom code etc in set up and configuration. How can I restrict a user from accessing everything ...
0
votes
1answer
39 views

Apex triggers to interact with sql server [closed]

We are in the beginning stages of getting set up in Salesforce, and there is something that I am having a little trouble getting my head wrapped around; We currently have a local SQL server ...
0
votes
1answer
36 views

New Button on Account overriden with Lightning Component

I have overriden 'New' button on Account with an aura component. So when a user clicks on New button , all the Account record types get populated. The issue is, user has access to only 2 record types ...
0
votes
1answer
44 views

Check if users email has been verified?

When the users email address is changed an email is sent to the user asking them to verify the change of the email. The user then clicks on the link and confirms the email change. Is there anywhere ...
0
votes
0answers
19 views

Testing security of APIs

I have created Rest APIs and I have been using Postman to try them out using the system admin credentials. (Where you call the APIs using password grant_type and use the user password and security ...
0
votes
0answers
27 views

Security Health Check - not able to load baseline due to “recent changes”

When I open Security Health Check setup page I get following error: We're sorry. Due to recent changes, your custom baseline must be updated. Please export a new copy of the Salesforce Baseline ...
0
votes
1answer
13 views

Disable Ability to Edit RecordType

I have a custom object with a Record Type that is read-only on the page layout but I can still make updates to the Record Type on the page. Why is this? I want to make the field un-editable, is there ...
0
votes
1answer
34 views

Require Login to View Lightning Component

Is there a way to require login before a user can see a Lightning Component in Salesforce Community?
1
vote
0answers
26 views

Import CA-Signed Certificate from One Org into Another via MetadataAPI

I am trying to automate the set up of some of my lower sandboxes. In my SandboxPostCopy class, I'm using the FinancialForce MetadataAPI wrapper MetadataService to query and upsert a certificate. (...
0
votes
0answers
4 views

Salesforce Consumer Goods Cloud

I'm implementing Salesforce Consumer Goods Cloud and on the Retail Store standard object OwnerId NOT showing under "Fields & Relationships", so I'm unable to add it to the Retail Store page layout/...
1
vote
2answers
417 views

“You do not have access to the Apex class named …”: cannot find the cause

I have developed a Lightning Web Component in a sandbox, consisting of HTML, JS, some actions and a few Apex classes. I have tested this as sysadmin and as another non-sysadmin user. No problems. ...
0
votes
1answer
23 views

Debugging best practices - callouts and security risks [closed]

What is the best practice for debugging callouts and their endpoints that are stored in custom metadata or custom settings? What are the possible threats and security risks if adding this sensitive ...
1
vote
1answer
16 views

XML format for IP Ranges in Security Settings

I'm trying to use sfdx for source based development. Trying to define the range of whitelisted IPs in Security.settings-meta.xml. When I push my code to my org I get an error: Error force-app/main/...
0
votes
1answer
30 views

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects? Can I check the above using AuthSession object's ...
0
votes
0answers
35 views

Chrome states “Not Secure” when on record page with Lighting Web Components

When I navigate to a record with a Lightning Web Component, my chrome browser lists "Not Secure" in the hyperlink bar. How do I configure either the Salesforce instance or my Lightning Web Components ...
0
votes
1answer
27 views

there an easy way to so a soql query to see the the applications a profile has access to?

I tried this query recently SELECT Id, Name FROM AppMenuItem WHERE Id IN (SELECT SetupEntityId From SetupEntityAccess WHERE Parent.ProfileId =: id) ORDER BY Label and got this error The selected ...
1
vote
0answers
25 views

Authentication via SFDC to “Approve” a record - Secure method needed [closed]

I have a unique requirement to build and am having trouble with the method to use to meet it. Working with a science lab that wants the ability to soft lock a record (via Validation Rule) that ...
0
votes
0answers
22 views

How to disable Settings link?

I am looking for disable the "Settings" option displayed in salesforce when clicking in the user circle for specific profiles. Thank you all!
8
votes
1answer
185 views

Can API access be limited to only via Apex classes?

We are building a product that offers two routes to the back-end data: JSON calls to @RestResource Apex class APIs LWC calls to @AuraEnabled Apex classes Is there a profile setup that keeps these ...
0
votes
1answer
23 views

Permision control of Notes and Attchments

How can we control the CREATE/READ/EDIT/DELETE permission of Notes and Attachments via Profile/Permission set? Is the permission of Notes and Attachments govern by the parent object like Account, ...
5
votes
1answer
56 views

Security stripInaccessible's SObjectAccessDecision getRecords() ordering

Is there a guarantee documented anywhere that the ordering of the SObjectAccessDescision's getRecords() method will match the ordering of the input list? It seems to be the behavior but I can't see ...

1
2 3 4 5
15