Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

How do we manage the upcoming MFA enablement for orgs with shared credentials?

Obviously it is against Salesforce's user agreement to share account credentials, but it does happen. For those shared accounts you would generally either disable MFA or use email authentication on a ...
2
votes
0answers
18 views

Salesforce security issue - Account owner's role of community user is given access to accounts the community user is linked to via cases

We have a security requirement where certain accounts should only be visible to a certain public group. To enable this we have a checkbox on the account and set our OWD to private. Any account with ...
3
votes
1answer
74 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
0
votes
0answers
17 views

Marketing Cloud SSO Config Failure - ReplyURL mismatch

I did all the configurations as mentioned in the steps here: Salesforce Marketing Cloud - Azure SSO Implementation I am redirected to IdP login screen, when I load the Marketing Cloud SP Url. But then ...
0
votes
0answers
22 views

Sharing Settings OWD [closed]

I am trying to change sharing settings for Account to be public read only and opportunity to be private, however it is not allowing to save the changes. I have tried also to make both account and ...
1
vote
1answer
76 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
0
votes
1answer
33 views

Whitelisting Salesforce IP addresses

We want to integrate Salesforce with one of our in-house applications. However, my networking team does not want to open the IP address (128.245.0.0/16 means 16,000 IPs) . How can we restrict the IP ...
7
votes
0answers
65 views

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

We are looking at setting up our Salesforce org as a public and secure endpoint target for a 3rd party application (Housecall Pro) which will be sending us webhook calls. The only rub is they cannot ...
3
votes
3answers
69 views

Is there a working Desktop Authenticator App for MFA? (with no mobile device involved)

I have very mixed feelings towards the enforcement of MFA by Salesforce, which as a consequence enforces the usage of authenticator apps. I have over 400 developer orgs to deal with. I have to login ...
3
votes
1answer
48 views

How to securely deploy secret key in custom metadata - 2GP Managed Package

I have recently created a managed package and I am preparing it for security review and final deployment. In the code I need to sign JWT used to authenticate against external API, for this purpose I ...
-2
votes
0answers
12 views

Whitelist SF IPs [duplicate]

We have an internal API that SF makes requests to. We're moving the app over to our AWS VPC so that users can only access it through VPN. I'd like to modify our security group inbound rules so that SF ...
3
votes
2answers
199 views

How can I encrypt a string in Apex in a way that an external system can decrypt using C#?

Our security team has found an issue in our lightning experience site where a link to an external system is adding the account # in the URL. That system is then using that account # to display data on ...
0
votes
0answers
18 views

Unable to see data in role hierarchy to above users

I have a chief sales officer role under CFO role, I gave permission in OWD public Read/write but I am unable to see the data of chief sales officer's in CFO user. both of user have assigned a profile ...
0
votes
1answer
38 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
1
vote
1answer
36 views

Named Credential ignores authorization header in apex

I have created a named credential, myNamedCredential, where Generate Authorization Header is True. When I look at the codebase, we have a trigger with code that will set the Authorization Header using ...
0
votes
1answer
57 views

When should we whitelist Community Cloud IP ranges? [closed]

As per the article Salesforce IP Addresses and Domains to Allow : Recommended for seamless access: Our best practice is to allow our entire set of IP ranges. This is to ensure our login pools can ...
3
votes
0answers
39 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0
votes
1answer
34 views

Trailhead login issue and security question [closed]

i am facing an issue. i was practicing something so i made a trailhead account. after timeout logout, i didnt know the password. when i click forgot password i received an email. after clicking that ...
0
votes
0answers
15 views

SSH Private Key is not accessible file Transfer Activity

I have a pair of SSH keys from my customer and I want to update them into Salesforce to use for Encryption and Decryption. I have no problems with an encryption key, it works just fine. But when I am ...
3
votes
1answer
33 views

Locking Down OAuth App Access in our Salesforce Org

I am looking to control Salesforce OAuth Application Access so it requires admin approval prior to being connected. Current Issue All employees at our organization have OAuth Access to Salesforce. ...
0
votes
1answer
45 views

Reports using different interfaces [closed]

I have created a report using classic but when another user creates the same report in lightning, some records are not displayed.
0
votes
2answers
69 views

Deploying an incomplete profile: how does Salesforce fill in the gaps?

If I create a blank profile in DX (minimal info, no object/field level security) and deploy it, the resulting deployed profile still has some object and field level security. How does Salesforce ...
2
votes
1answer
32 views

How to automatically apply Release Updates?

I see the with the new Release Updates page there is now an API to list release updates in the Tooling API as a ReleaseUpdate sobject. There is also a ReleaseUpdateStep and ReleaseUpdateStepLog ...
0
votes
1answer
37 views

Restricting access to create Reports in Salesforce

We have three different sister companies within our salesforce org. Account and Contacts are readable for all users irrespective of Business units. However, I need to provide create and export report ...
0
votes
1answer
33 views

Security with Mixed SObjects

I am attempting to find best practices around mixed SObject security. When I am using DML statements I validate either through "with SECURITY_ENFORCED" or through {SObject}.SObjectType....
0
votes
0answers
75 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
0
votes
1answer
42 views

Is this better to store system-defined credentials in a middleware layer or in custom settings?

For an outbound integration from Salesforce to External System, is this better to store system-defined credentials in a middleware layer or in Custom Settings or in Static Resource? Is this secure to ...
7
votes
1answer
138 views

Workbench end-of-life? [closed]

I have my own instance of Workbench running on Heroku and have recently started receiving the following email after deployment: Your recently built app XXXXXX is using the Heroku-16 stack, which is ...
0
votes
1answer
28 views

Need help with Data Security requirement

Below is my requirement: There are multiple programs within the org and I have this requirement. Part 1: Profile A should only be able to see Program A data (Accounts, Customers, etc..) Part 2: ...
11
votes
0answers
98 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
0
votes
1answer
24 views

Validation Rule on Task AssignedTo Standard Field

I have put the following Validation Rule on the AssignedTo field on Task to avoid changing task owner if the logged in user is also the owner of the task NOT(ISNEW()) && $User.ID = OwnerId &...
0
votes
0answers
20 views

Why my community plus user cannot see child records of a parent that has been shared with him?

I'm still trying to find my sea legs with Salesforce record access and it's quirks, so please walk me through your thought process, I might be missing something really obvious here. I have 3 custom ...
0
votes
0answers
32 views

I wanted to know that under what circumstances is the sharing button enabled on the detail view for a record?

Now, I have a custom object for which I have the OWD set as private, then I am able to see the sharing button on the detail page of the record, but even if I set it to public read/write, I can still ...
0
votes
0answers
18 views

Lightning out - provides access to the org

When I load a site page that contains a Lightning component, access to the org opens. That is, in the neighboring tab, I can take a working link and go to the accounts for example. (the browser is ...
0
votes
0answers
27 views

Transaction Security Policy - Stop connectors(Data loader, Excel connectors, workbench, etc.. ) to do DML in salesforce

I got a requirement where I need to stop my users to perform the update, insert, and upset from any connector(Excel connector, workbench, data loader, etc..) even if they have access in the profile. I ...
0
votes
0answers
45 views

Access on UserDevice sObject

I am trying to query on UserDevice sObject but in the documentation it is mentioned "You must have View Devices enabled to see devices.". So can anyone please tell me how to do this to be ...
0
votes
2answers
70 views

Not able to find reset token option in sandbox instance

I am not able to find the Reset Security token Option under the settings option in my partial sandbox instance. Can someone please let me know how to find it. Or if I am missing out on anything. I am ...
1
vote
1answer
161 views

Re-enabling the ability to impersonate External Users via “Log in to Experience as User” button (Spring 21)

Some Platform Users in my org used to be able to impersonate Community (now "Experience") users from the Contact record by using the "Log in to Community as User" button. After ...
0
votes
0answers
18 views

Go to a public Community Home page from base URL

The goals is to have a public home page of a community. That the users do not have to login to see. And when users hits the base URL of the community it is redirected to that public home page. https://...
0
votes
1answer
155 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
0
votes
0answers
33 views

Salesforce security - controlling app access to the org

Guess I wasn't clear about my question - it goes to the question of Salesforce Security. How does a SFDC Admin control the applications that access the org. The following is explanation of the issue: ...
1
vote
1answer
24 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
4
votes
1answer
126 views

Why is stripInaccessible removing an M-D field?

I am building and LWC which uses lightning-record-edit-form to create an object, then calls an Apex controller method to create a list of M-D children of the newly created object. In my current test, ...
0
votes
0answers
28 views

Cannot get custom font to work in Community Pages- have tried many things to fix

I followed these instructions to the letter in my Dev Org: https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_customize_font.htm I've tried ...
2
votes
1answer
109 views

Winter '21 LWC “script-src” issue with lightning-record-form

We have an LWC component that leverages the lightning-record-form to allow records of a specific custom object to be created or edited. The form uses an object layout to define the fields to edit, and ...
0
votes
0answers
21 views

connecting roles to records

In this tutorial, the instructor configures roles hierarchies, but in don't have the same options of what to do with them: tutorial: Who Sees What: Record Access Via Roles (Lightning Experience) Her ...
4
votes
3answers
106 views

What is the risk of not performing Field Level Security (FLS) checks on internally developed Apex code?

I see more and more information about the importance of performing FLS checks before SOQL and DML operations, using the Security.stripInaccessible method, e.g. in the Winter '21 PD1 certification ...
1
vote
1answer
111 views

How to implement PKCE flow in Salesforce

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
1
vote
1answer
126 views

PCKE flow Salesforce for OAuth 2.0

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
0
votes
0answers
22 views

Private Settings managed packaged issue

Have someone ever faced package named Private Settings? There is need to take a glance at the classes methods if it possible. I'm gonna use that one to reach out custom API but don't have a clear idea ...

1
2 3 4 5
16