Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
1 vote
2 answers
50 views

How to make the code resource URL private for SFMC use only

I need to restrict the access of code resource endpoints to SFMC use only. Some update codes are added in SSJS which will be called from SFMC. In case the URL is exposed somehow, I don't want to have ...
  • 119
0 votes
0 answers
22 views

How to get users that have access to a record with given ID?

I have an ID of a record from the custom object Job_Application__c. Is there any SOQL query or Apex method that enables to get IDs of users that can see that record? (I mean sharings to that given ...
  • 11
0 votes
1 answer
38 views

Why is an API User with R/W access to a lookup field, getting an INVALID_FIELD error?

My API user makes the following query in Salesforce via the Standard REST API. They have Read / Edit privileges on the Contact__c field and Modify All on the Channel__c object. They do not have access ...
2 votes
1 answer
41 views

Prevent flows from writing sensitive data to debug logs in plaintext

We have a screen flow that collects a password from the user using a Password field component. That masks the input on screen, but when looking at debug logs, the value of that field gets written to ...
1 vote
0 answers
25 views

Secure key storage to validate webhook signature

It's the {current_year}. How does Salesforce suggest storing API keys when they are used outside callout context (solved very well using Named Credentials)? Looking at previous discussion, "...
  • 4,558
0 votes
0 answers
12 views

User-invoked disabeling of an account to run in a flow for their specific public group

I'm really scratching my head on this one. I'm new to Salesforce (8 months) and I've created a flow to automate our AR process. We have 89 public groups that control privacy. Right now, the flow is ...
0 votes
1 answer
30 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
  • 3,315
-1 votes
1 answer
50 views

SFDC's out-of-the-box email to case security standards

We are in the midst of HITRUST certification info-gathering and remediation steps, and because we have SFDC's out-of-the-box email to case as a communication tool, we are looking to understand its ...
0 votes
0 answers
44 views

Giving community users access to records via junction object

I have a junction object called Junction__c. It has Master-Detail to PersonAccount and another object called Mortgage__c. I have a checkbox on Junction__c called Access_Granted__c. When this checkbox ...
  • 446
0 votes
1 answer
32 views

How can I stop Email Preview from executing API calls?

Trying to institute tokenized links in the emails that will allow users to sign-in to the company's website without having to enter credentials. Tokenized links are generated by the company backend on ...
  • 173
0 votes
0 answers
17 views

Granular Control on Chatter Posts

I have a use case where we have a group of Profiles that need to have access to edit their Chatter Case comments for 24 hours and then those posts become locked for them and no longer editable. They ...
0 votes
2 answers
35 views

How to control edit access to Role?

I have a role Sales Manager. The sub roles of Sales Manager are Sales Rep A and Sales Rep B. The records created by Sales Rep A user and B user are seen by Sales Manager. It is done by Role level ...
0 votes
1 answer
42 views

Cannot create IsAccessible statement for User object

I'm trying to create this statement: if(User.sObjectType.getDescribe().isAccessible()){ User userData=[SELECT id, Profile.Name FROM User WHERE id=:user.id]; return userData.Profile....
  • 185
0 votes
1 answer
68 views

Visualforce and LWC Security Concerns [closed]

I’m trying to find an example of security issues in VF or LWC. If that security vulnerability really exist in the code, and if that vulnerable code is deployed to a Salesforce prod org or Salesforce ...
  • 23
1 vote
0 answers
35 views

"Nested" Named Credential Callout

I have a named credential, let's call it NC1, setup for a custom AWS endpoint. This works great using the endpoint and an access key. However, as part of the body of NC1, I need to send an auth ...
  • 317
0 votes
1 answer
113 views

Establish a connection from Salesforce to VPN

Some of our API endpoints cannot be accessed from SFMC without connecting to the VPN network. We need to fetch information from these endpoints. Is VPN tunneling possible from SFMC? currently, it is ...
0 votes
1 answer
134 views

Gave User Read Only Permission In Sharing Setting but Able to Edit Records when OWD is Private

I want a user to see all the records of Quote object of other users based on some criteria, I created a sharing rule on the opportunity to share records with that user and gave read-only permission ...
0 votes
0 answers
79 views

Allow only 1 profile to Merge Accounts

Use Case: Only users from a profile 'CSX' should have the ability to Merge Accounts. No matter who owns the Acount, when Accounts need to be merged only this profile can Merge the records. Security ...
0 votes
2 answers
75 views

SalesForce Workbench Architecture

We are performing a security review of the WorkBench tool before allowing external consultants access to our Salesforce organization for viewing the structure and relationships to develop reports. I ...
0 votes
0 answers
43 views

Save Custom logout url through Apex code

In Setup >> Security Controls >> Session Settings >> Logout Page Settings. System Admin can define Logout Page URL. Can we set this via Apex Code or Metadata API ?
2 votes
2 answers
217 views

Lightning Web Security breaks LWC with svg use tag

When there is a LWC using svg use tag like suggested on Lightning design system site and Lightning Web Security is turned on (the setting Use Lightning Web Security for Lightning web components on ...
  • 13.9k
2 votes
1 answer
63 views

How often does Salesforce change the keys at https://login.salesforce.com/id/keys?

How often does Salesforce change the keys change at https://login.salesforce.com/id/keys ? Context A client wants to verify the JWT signature generated for Salesforce's OpenID Connect token However, ...
  • 2,092
1 vote
1 answer
63 views

What permissions on a profile/permission set should be considered "privileged user" or "system admin" access?

I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because ...
1 vote
1 answer
23 views

How is attachment access controlled by record level

By looking at the permission set and profile metadata files, I don't see a place defining the access to contentDocument or ContentVersion so I originally assumed it should be controlled by parent. ...
  • 12.8k
1 vote
1 answer
25 views

API Enabled User Use Which Sharing ? Extenal Default or Internal

I am making a user API Enabled. By turning ON the permission 'API Enabled'. What I am trying to figure out is, when this user is accessing data from salesforce with an external application. Which ...
-1 votes
1 answer
41 views

Security setting on report type

How can I allow reporting on only one report type(there is only one custom object in this report type) for a particular profile in salesforce? All other report types should be hidden/not selectable by ...
0 votes
0 answers
34 views

Enforce CRUD on single record DML statement

As the title suggests I am trying to enforce CRUD on a DML statement for a single record. I see the stripInaccessible() method takes in a list of sObjects. Is there an equivalent method for a single ...
  • 317
0 votes
0 answers
82 views

Not Able To Access Records In Role Hierarchy

I am a salesforce developer but new to admin. Tring to understand security settings using role hierarchy and having an issue or confusion here. I'll try to explain this below. I have two roles in the ...
0 votes
0 answers
37 views

Visualforce Public Form DoS Security

I have created a public registration form for clients. No login/credentials are required to submit the form. It is reachable via a custom url of this format: my-custom-subdomain.force.com. It is built ...
  • 11
0 votes
0 answers
104 views

Problem Logging In - No_Oauth_State: State was not sent back

I would like to connect GoToApi with Salesforce Org. According to their documentation, I need to go to this URL to get the authorization code: https://api.getgo.com/oauth/v2/authorize?client_id={...
  • 313
0 votes
0 answers
118 views

Custom Email Confirmation Page in Experience Cloud

I have a problem, when Customer Community Login user change their email, old and new emails with address confirmation are sent by SF and standard page with button opens. Is there any way to replace ...
0 votes
0 answers
99 views

lightning:recordEditForm not rendering when user has read-only data-level security

I have a custom object that is a child of Opportunity so its data-level security is controlled by its parent (Opportunity) sharing settings. All of my user Profiles have Object-level permissions set ...
4 votes
2 answers
197 views

LWS - Apparent difference in behavior using data returned from Apex call

Prior to enabling LWS in Spring '22 we were able to successfully 'modify' objects returned from an Apex Call. After enabling LWS we cannot modify the data. Allow me to give an example. Below is some '...
0 votes
1 answer
32 views

Does Upgrading Major Version Number Trigger Security Review

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
0 votes
1 answer
169 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
  • 13.9k
0 votes
1 answer
158 views

FLS Create Security Risk still appears even though object is checked if it is creatable

So I have this code: obj.field1__c = 'placeholder'; if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){ insert obj; } When I receive the (Checkmarx Source Scanner report), I still get ...
-2 votes
1 answer
555 views

Access to account team member object

I have a custom profile and the assigned user is not able to see buttons 'Add Default Team', 'Add Team Members' etc. At the time of creating custom profile I had given only Read, Edit permissions on ...
0 votes
1 answer
224 views

Salesforce Sharing settings for price book shows option as "Use". How its different form Public View and Public read write?

Salesforce Sharing settings for price book shows option as "No Access", "View Only" & "Use". How "Use" is different form "View only" and Public ...
  • 8,990
0 votes
1 answer
3k views

gets “System.QueryException: Insufficient permissions: secure query included inaccessible field” error

We have a query that is executed by an “experience site/community” user. The user has “Partner Community” license and “Partner Community User” profile. This user executes code containing the following ...
1 vote
1 answer
132 views

Does workbench store or cache data anywhere outside of Salesforce?

If you import a data file into workbench for querying or attempting to load into Salesforce, is it stored anywhere outside of Salesforce that may need to be purged?
3 votes
1 answer
346 views

Workbench - CVE-2021-44228

This is relative to the CVE-2021-44228 log4J vulnerability. Is anyone aware as to the impact on Workbench? A POC for Salesforce support said it was impacted. If so - would anyone know how it ...
2 votes
1 answer
1k views

WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL

Premise: I followed WITH SECURITY_ENFORCED, Security.stripInaccessible and comparison before designing my Apex class for querrying a few records. Doubt: I implemented my SOQL as Security....
  • 427
2 votes
1 answer
63 views

How to prevent other people to unsubscribe on behalf of the subscriber?

Is it possible for a person other than subscriber to unsubscribe for them. For instance, assuming subscriber receive a email with button to that redirect it to a cloudpage with unsubscribe link on it, ...
1 vote
1 answer
507 views

How to exempt Automated Testing Users from MFA requirement?

We are in the process of turning on MFA. We have enabled it for the appropriate Profiles and it works fine for most users. We have a couple of automated testing users in the Profiles that have the ...
0 votes
0 answers
20 views

Showing report charts in digital experiences/ communities to guest user

I'm trying to figure out how to display report charts to unauthenticated users in salesforce digital experiences. In a way that isn't going to compromise anything. Is this possible or do I need to ...
0 votes
0 answers
58 views

MFA Multiple Verification Methods, change order of precedence

Salesforce has an order of precedence for verification methods when logging in with MFA: Salesforce Authenticator. Time-based one-time passcode (TOTP) authenticator apps. Built-in authenticators. ...
1 vote
1 answer
91 views

Will record data be visible via API if shared using sharing records with Guest User on Communities?

We are setting up a public Communities page. This page will publish a flow to capture leads but the flow must have read access to Account and another custom object to do its job. Communities requires ...
-3 votes
1 answer
185 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
5 votes
1 answer
103 views

How to deal with the security of odd standard fields?

We are using the Security.stripInaccessible method to identify fields that don't have the proper DML permission to insert, update etc. It works good for the most part but it gives us some false ...
0 votes
0 answers
262 views

Impact of "Enable clickjack protection for customer VisualForce pages with standard headers"

Can anyone tell me what could be the impact in Org if Admin enables session setting "Enable clickjack protection for customer VisualForce pages with standard headers" I totally understand ...

1
2 3 4 5
17