Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Security Scanner Report in Owasp zap

I Have developed an application in a salesforce Developer Org that needs to create Security Scanner Report by using Owasp zap. Need to scan forms associated with my app such as Apex class, All the ...
0
votes
0answers
22 views

Is Salesforce MFA Built In Authenticator alone enough?

Does Built-In Authenticator (Beta) alone satisfies MFA requirement set by Salesforce ? or we need to setup other mechanism also like Salesforce Authenticator ?
-5
votes
0answers
14 views

I need help in interview questions for experienced Salesforce developer [closed]

Can you please help me with the latest interview questions for experienced Salesforce developer and admin? The topics are: Experience cloud CPQ Salesforce configuration(Security, validation rule and ...
5
votes
1answer
62 views

How to deal with the security of odd standard fields?

We are using the Security.stripInaccessible method to identify fields that don't have the proper DML permission to insert, update etc. It works good for the most part but it gives us some false ...
0
votes
0answers
18 views

Impact of "Enable clickjack protection for customer VisualForce pages with standard headers"

Can anyone tell me what could be the impact in Org if Admin enables session setting "Enable clickjack protection for customer VisualForce pages with standard headers" I totally understand ...
-1
votes
2answers
40 views

Best Practices for Storing API Key?

I have a Lightning Web Component that makes a fetch() request straight from the component's JavaScript. For testing and development I've simply stored the API key as a variable, but I'd like to back ...
0
votes
1answer
31 views

Is it ok to store a bearer token in a custom field in the user object [closed]

I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. ...
5
votes
1answer
80 views

Is there a security hole in Salesforce's documentation?

I was looking at Salesforce's documentation for implementing an OAuth callback and I noticed they are accepting a "sfdc_community_url" from the client, which should normally only ever be a ...
0
votes
0answers
13 views

Security in Cloudpages when using Java Script flow frame-work to call app and customer can input their details on that app called by Javascript

We are developing a cloudpage (Landing page) in marketing cloud and on that landingpage there is a button called "Get Started" so once customers land to this cloudpage they can click on &...
0
votes
2answers
46 views

Salesforce Backup Process

I would like to be informed about Salesforce Backup Process (Security Management). I would like to know more about the Standard Recovery Process if any. How often is the Salesforce backup taken? ...
0
votes
0answers
24 views

Unable to disable XSS-Protection

I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
0
votes
0answers
34 views

REST API. Sending sensitive data in URL . Security issue

I have a security issue. I built an app that interacts with WordPress and its plugins via REST api, gets and posts some info and syncs it with Salesforce data. I have apex classes that perform HTTP ...
0
votes
1answer
22 views

Can I view a record if that record type / page layout is not assigned to me in salesforce

If I have access to 2 record types of an object and someone who has an access to a 3rd record type assignes me that record (which was created using that 3rd record type), will I be able to view it?
0
votes
1answer
23 views

Auth Provider configured as High Assurance continues to prompt users for MFA?

Our users currently log into our org using their salesforce username and password credentials along with their registered verification method of choice for Salesforce's own MFA prompt. We're now in ...
0
votes
2answers
45 views

What is isCreatable and isUpdateable for FIELDS in GUI

Where can I find and enforce "CREATABLE" and "UPDATEABLE" options for fields? Because, i am able to check the permissions in Apex(below statements) whereas, not able to find what ...
1
vote
0answers
32 views

Can RSA SecurID be used as Salesforce MFA?

Next year MFA will be required (Salesforce MFA Doc) and the customer has RSA SecurID as 2FA for other applications, We would like to know if we can use SecurID as a third-party authenticator app for ...
0
votes
0answers
10 views

How to provide CRUD permissions over groupmember object

For a non-admin user(Salesforce Platform license) with minimal/specific permissions, we want user to access groupmember record programmatically, for CRUD operations (especially Delete). However, while ...
0
votes
0answers
16 views

Salesforce implicit sharing - does access to account records via implicit sharing open up access to contact records as well?

If OWD is set to private and access to case record opens up the access to account Record via implicit sharing, will that also open up the read only access to contacts related to those accounts? ...
0
votes
0answers
8 views

Why can the member of a delegated group assign profiles not listed as assignable?

Two sandboxes are set up with the same assignable profiles in a delegated group under Delegated Administration. In one sandbox, users can only set up new users with one of the assignable profiles ...
2
votes
1answer
59 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error thrown in random places

Recently I've started getting error message: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Access to entity 'AIInsightValue'...
2
votes
1answer
48 views

Marketing Cloud SSL DIY Setup Cheaper?

I'm a marketing cloud and ssl newbie, so forgive this newb question. So, we have 2 business units with SAP needing 4 SSL Certificate, I contacted our account exec to get a quote. The total was ($6.5k) ...
0
votes
0answers
19 views

Visual Force expose on External Site - Manage access

I have a need to create a visual force page that will be accessible on an external web site, it will be displayed in an Iframe. The page will be accessible only for specific web site user after login. ...
0
votes
1answer
27 views

How to restrict users to access accounts they do not own associated with cases they do own

We have two companies with their seperate roles hierarchy under same organisation. The hierarchy is same for both companies CompanyA Manager - CompanyA Processor - .. CompanyB Manager - CompanyB ...
0
votes
1answer
172 views

Should Named Credentials be used to store an API Callout Bearer Token?

Problem I have a straightforward REST API callout in apex. request.setEndpoint('https://api.websitename.com'); request.setMethod('GET'); request.setHeader('Authorization','Bearer ...
2
votes
0answers
22 views

Salesforce security issue - Account owner's role of community user is given access to accounts the community user is linked to via cases

We have a security requirement where certain accounts should only be visible to a certain public group. To enable this we have a checkbox on the account and set our OWD to private. Any account with ...
3
votes
1answer
99 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
0
votes
0answers
19 views

Marketing Cloud SSO Config Failure - ReplyURL mismatch

I did all the configurations as mentioned in the steps here: Salesforce Marketing Cloud - Azure SSO Implementation I am redirected to IdP login screen, when I load the Marketing Cloud SP Url. But then ...
1
vote
1answer
225 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
0
votes
1answer
74 views

Whitelisting Salesforce IP addresses

We want to integrate Salesforce with one of our in-house applications. However, my networking team does not want to open the IP address (128.245.0.0/16 means 16,000 IPs) . How can we restrict the IP ...
7
votes
0answers
92 views

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

We are looking at setting up our Salesforce org as a public and secure endpoint target for a 3rd party application (Housecall Pro) which will be sending us webhook calls. The only rub is they cannot ...
3
votes
3answers
96 views

Is there a working Desktop Authenticator App for MFA? (with no mobile device involved)

I have very mixed feelings towards the enforcement of MFA by Salesforce, which as a consequence enforces the usage of authenticator apps. I have over 400 developer orgs to deal with. I have to login ...
3
votes
1answer
65 views

How to securely deploy secret key in custom metadata - 2GP Managed Package

I have recently created a managed package and I am preparing it for security review and final deployment. In the code I need to sign JWT used to authenticate against external API, for this purpose I ...
4
votes
2answers
344 views

How can I encrypt a string in Apex in a way that an external system can decrypt using C#?

Our security team has found an issue in our lightning experience site where a link to an external system is adding the account # in the URL. That system is then using that account # to display data on ...
0
votes
0answers
24 views

Unable to see data in role hierarchy to above users

I have a chief sales officer role under CFO role, I gave permission in OWD public Read/write but I am unable to see the data of chief sales officer's in CFO user. both of user have assigned a profile ...
0
votes
1answer
98 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
1
vote
1answer
97 views

Named Credential ignores authorization header in apex

I have created a named credential, myNamedCredential, where Generate Authorization Header is True. When I look at the codebase, we have a trigger with code that will set the Authorization Header using ...
0
votes
1answer
89 views

When should we whitelist Community Cloud IP ranges? [closed]

As per the article Salesforce IP Addresses and Domains to Allow : Recommended for seamless access: Our best practice is to allow our entire set of IP ranges. This is to ensure our login pools can ...
3
votes
0answers
45 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0
votes
1answer
37 views

Trailhead login issue and security question [closed]

i am facing an issue. i was practicing something so i made a trailhead account. after timeout logout, i didnt know the password. when i click forgot password i received an email. after clicking that ...
0
votes
0answers
18 views

SSH Private Key is not accessible file Transfer Activity

I have a pair of SSH keys from my customer and I want to update them into Salesforce to use for Encryption and Decryption. I have no problems with an encryption key, it works just fine. But when I am ...
3
votes
1answer
36 views

Locking Down OAuth App Access in our Salesforce Org

I am looking to control Salesforce OAuth Application Access so it requires admin approval prior to being connected. Current Issue All employees at our organization have OAuth Access to Salesforce. ...
0
votes
1answer
56 views

Reports using different interfaces [closed]

I have created a report using classic but when another user creates the same report in lightning, some records are not displayed.
0
votes
2answers
80 views

Deploying an incomplete profile: how does Salesforce fill in the gaps?

If I create a blank profile in DX (minimal info, no object/field level security) and deploy it, the resulting deployed profile still has some object and field level security. How does Salesforce ...
2
votes
1answer
36 views

How to automatically apply Release Updates?

I see the with the new Release Updates page there is now an API to list release updates in the Tooling API as a ReleaseUpdate sobject. There is also a ReleaseUpdateStep and ReleaseUpdateStepLog ...
0
votes
1answer
76 views

Restricting access to create Reports in Salesforce

We have three different sister companies within our salesforce org. Account and Contacts are readable for all users irrespective of Business units. However, I need to provide create and export report ...
0
votes
1answer
35 views

Security with Mixed SObjects

I am attempting to find best practices around mixed SObject security. When I am using DML statements I validate either through "with SECURITY_ENFORCED" or through {SObject}.SObjectType....
0
votes
0answers
86 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
0
votes
1answer
46 views

Is this better to store system-defined credentials in a middleware layer or in custom settings?

For an outbound integration from Salesforce to External System, is this better to store system-defined credentials in a middleware layer or in Custom Settings or in Static Resource? Is this secure to ...
7
votes
1answer
150 views

Workbench end-of-life? [closed]

I have my own instance of Workbench running on Heroku and have recently started receiving the following email after deployment: Your recently built app XXXXXX is using the Heroku-16 stack, which is ...
0
votes
1answer
29 views

Need help with Data Security requirement

Below is my requirement: There are multiple programs within the org and I have this requirement. Part 1: Profile A should only be able to see Program A data (Accounts, Customers, etc..) Part 2: ...

1
2 3 4 5
17