Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
-3 votes
0 answers
35 views

(urgent) Epic Games Player Support Security requires users to contact from their oldest devices in order to recover their accounts. How can I bypass? [closed]

This is a million dollar problem. If your Epic Games account was hacked or inactivated, Epic Games has this security measure that requires users to contact Player Support using their oldest devices (...
paiidkhan's user avatar
2 votes
1 answer
52 views

What is the meaning of Type field on PermissionSet standard object in Salesforce?

Documentation page about permission set provides a limited information about Type field. Type: reference Properties: Filter, Group, Nillable, Sort Description: Available in API version 46.0 and later....
Patlatus's user avatar
  • 16.1k
0 votes
0 answers
29 views

SSO using SAML - Error using Heroku App setting Up SAML

I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5 I setup SSO ...
SfdcBat's user avatar
  • 4,761
-1 votes
0 answers
32 views

OAuth 2.0 verification

does anyone have Oauth 2.0 documentation that can help me verify if I have configured my integration correctly thank you!
Anjalee's user avatar
0 votes
0 answers
17 views

How does the CampaignMember object work in terms of record visibility?

I am trying to understand how the CampaignMember object behaves in terms of security. According to the Salesforce documentation, in order for a user to view a CampaignMember record the user must have ...
Tzinm's user avatar
  • 1
1 vote
0 answers
71 views

How does Permission Sets works against Licenses of Managed Package

We have built a Second Generation Managed Package and want it to be available as paid version in AppExchange Portal. So If a user buys it from AppExchange, he/she gets the licenses to use the solution....
S1th's user avatar
  • 69
1 vote
1 answer
160 views

Why is OAuth Client Credentials safer than OAuth Username-Password?

According to Salesforce, here "You can use the username-password flow to authorize a client via a connected app that already has the user’s credentials. However, we recommend avoiding this flow ...
Morgan Marchese's user avatar
3 votes
1 answer
88 views

Enforce User Mode in Dynamic SOQL - String or Parameter?

Is it equally appropriate and safe to use each of those Dynamic SOQL calls with USER MODE or should I prepare one over the other? The official documentation doesn't make that clear. User Mode as part ...
Robert Sösemann's user avatar
-1 votes
1 answer
64 views

Does 'View all data' permission in salesforce give users access to private reports of another user? [closed]

Does 'View all data' permission in salesforce give users access to private reports of another user? Couldn't find any exact theory on this.
Vats Mittal's user avatar
1 vote
1 answer
120 views

How to Resolve the Apex PMD Rule "ApexOpenRedirect"

community. I am currently working on a custom plugin for an Auth Provider in Apex and have encountered the error message "Apex classes should safely redirect to a known location (rule: Security-...
Josue0117's user avatar
0 votes
1 answer
43 views

Lookup query exception while using USER_MODE

I am trying to create a 2GP package. But whenever I try to create a version by running and validating all test classes and metadata, the test class fails and shows such an error. "common.apex....
AJITHKUMAR VP's user avatar
-1 votes
1 answer
48 views

Perform DML on Salesforce Object from non-salesforce user

I have a requirement to send an email to individuals who are neither Salesforce users nor community users. Within the email, there is a hyperlink, and when they click on it, I need to update the ...
Amol Girme's user avatar
0 votes
0 answers
79 views

Callout named credential calls with a blob body

I am trying to launch a callout call to an OCR from an Apex method using a secured named credential with an external credential. The HTTP request is a POST request with multipart body containing a ...
Diaboloxx's user avatar
0 votes
0 answers
120 views

Programmatically edit authentication parameter of external credentials

I was wondering if updating an authentication parameter of an External Credential was possible from an Apex method. The main goal of this function would be to programmatically store an access token ...
Diaboloxx's user avatar
2 votes
1 answer
69 views

Best Practices for CRUD/FLS/SHARING checks in unmanaged code

I'm auditing an ORGS unmanaged Apex and trying to form a concrete framework for when I care about PMD warning for ApexCRUDViolation & ApexSharingViolations. It's always been my understanding that ...
NSjonas's user avatar
  • 10k
-1 votes
1 answer
55 views

Check if user have set security Question

Is there a soql that system admin can execute to list users who have set security question during their past logins? Thanks,
MBM's user avatar
  • 89
-1 votes
1 answer
39 views

How to make an attached document to record visible only for the owner

How to make an attached document to record visible only for the owner of record (custom object) and not visible for other users (for wish record is visible)?
Pedro Van's user avatar
0 votes
1 answer
53 views

Do I need to check FLS for each field when creating a new object record in apex?

If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
lhh13's user avatar
  • 41
0 votes
1 answer
20 views

How to detect Formula Expressions exposing vulnerable information like session id?

There is a snippet from the Salesforce Security Guide (Version 58.0) Formula Tag heading explaining why it is a security vulnerability : The general syntax of these tags is:{!FUNCTION()} or {!$OBJECT....
compski's user avatar
  • 1,251
-1 votes
1 answer
178 views

Is WAF implemented for Salesforce APIs?

Our client's cybersecurity team is inquiring if Salesforce implements WAF (web application firewall) for its standard APIs. We have a salesforce application using Sales, Service and Experience cloud. ...
Shamina's user avatar
  • 4,185
0 votes
1 answer
44 views

Validate OWD, with sharing, Profile, Permission Sets as Non - ADMIN user

I am trying to validate the OWD for an object that is Public/Read Write without Read permission at the object level for a specific profile user. To validate the results I created a new profile by ...
indrasen neelam's user avatar
2 votes
2 answers
165 views

Insecure Storage of Sensitive Data Vulnerability for a security review

We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ". I am making a call to external service to get a encrypted claim that i am using to ...
Manjot Singh's user avatar
  • 3,406
0 votes
0 answers
41 views

Check whether generic SObject is updateable

How do I check whether a generic SObject is updateable before DML operation. For standard and custom objects I know the general pattern is: Schema.sObjectType.Account.isUpdateable() However if I have ...
lhh13's user avatar
  • 41
1 vote
1 answer
258 views

Restrict access to specific fields when using Salesforce Integration User Licence on Standard objects (like Contacts)

By default, the Salesforce Integration User Licence doesn't provide access to a variety of standard objects (including Contacts and Accounts). You can extend the access for an integration to those ...
Nathan McQueen's user avatar
-1 votes
2 answers
56 views

Data segregation for high confidentiality

I work at a bank and we currently use one single org to simplify our processes, but we have a department with highly confidential info. I’m trying to find a way to “separate” the data from this ...
Luis Bazzoli's user avatar
0 votes
0 answers
81 views

Only Create Access but edit and delete using permission set

I have an requirement that profile need to give creating the record but delete and edit access should be done by permission set. In profile on FLS I gave read and edit acccess to all field or else we ...
Arjun's user avatar
  • 3
0 votes
0 answers
428 views

Able to view the Account records even though OWD set to private and removed all permissions like view all & modify all

I have created the sharing rule to share ony specific record type record to shared with a group. my object is Account and Org-Wide Defaults set to the Private, removed the permissions like view all &...
BRAHMA REDDY's user avatar
0 votes
0 answers
29 views

Granting Access to a Managed Package

We are developing a managed package that will be published. We want to control access to our application based on user LICENSE. However, we are unsure about the most effective method to achieve this. ...
APEX PREDATOR 3000's user avatar
0 votes
1 answer
142 views

OWD Sharing Settings and Account Sharing Rule

I'm unable to get this working in my companies Sandbox so I've spun up a brand new Developer Edition Org to see if I can replicate the issue. Being a brand new org there are no permission sets, ...
Matthew Harris's user avatar
0 votes
0 answers
87 views

API endpoint - Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org

I didn't find any, maybe you can help. I am looking for the API endpoint of Session Settings -> Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org. I found ...
Yuavl_Dayan's user avatar
0 votes
0 answers
21 views

Access Permissions of Files -Salesforce and Share Point integration

We're exploring option to build integration between Salesforce and Share Point. We're looking into various options like File Connect or appExchange tools but we're getting stuck at one important point-...
sfdc_Qrius's user avatar
2 votes
1 answer
479 views

Cannot Add Principal To Named Credential

I am trying to create a named credential with a principal using the instructions at this URL - Using API Keys with Named Credentials But, in the "Store an API Key as an Authentication Parameter ...
Tom Ansley's user avatar
0 votes
0 answers
108 views

Security Predicate for Community User

For a community user to see relevant records in community, what should be the security predicate if account owner id and related opportunity owner is owned by the logged in user? I understand that ...
MnZ's user avatar
  • 3,152
0 votes
1 answer
295 views

Salesforce External Credentials Custom Body

I was configuring external credentials in Salesforce, but I noticed, there's no Custom Body on it, is there any way to add it using OAuth 2.0 Authentication Protocol? I'm only seeing Custom Headers ...
Erick Villamayor's user avatar
1 vote
0 answers
45 views

Restrict field edit access

My org has OWD as Private for opportunities. I have a specific requirement where one user needs to be able to edit 3 custom fields in all opportunities , but not other fields should be editable. No ...
Eddy's user avatar
  • 11
0 votes
0 answers
33 views

Setup Activity object security

I have a problem while setuping security for Activity object. The problem is standart behaviour of OWD setting for Activity. Even If i set private records are shared to people who has Read access to ...
Maksym Mahyrevych's user avatar
0 votes
1 answer
28 views

Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?

On one legacy project the following pattern was implemented. Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
Patlatus's user avatar
  • 16.1k
0 votes
0 answers
46 views

Securing API access to Salesforce from a custom mobile app

Custom mobile application sends requests to a custom REST web service on Saleforce. The request contains an external ID, which is saved on the Contact standard object along with customer data. This ...
DevelBase2's user avatar
2 votes
2 answers
197 views

Guest Use Access Report Package AuraEnabled ApexClasses

This article was recently published and caught the eye of our leadership team: https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/ The article recommends using ...
gNerb's user avatar
  • 9,441
0 votes
0 answers
41 views

can we create sharing rule on contentdocumentlink object for share an files/image to guest user in experience cloud?

I am storing images in files and I want to get that images without authentication for guest users. So I want to create sharing rule on contentdocumentlink object and share records with guest users. So ...
parth patel's user avatar
0 votes
0 answers
84 views

How can I restrict the user from Editing the Account Site Field of account Object using profile settings?

I am facing some issue here regarding field level security in Profile Sales Admin (Cloned From System Administrator) Object Level Security (Standard object permission) Account Object | Only Read ...
salesforce Newbie's user avatar
0 votes
0 answers
29 views

Issue with Creating records thru flow with all access data in community portal

Current Config Organization-wide setting - Sharing Setting Custom Object LeadStage - External sharing - Public Read /Write Community Portal Guest User Profile Custom Object LeadStage - Create, Edit ...
Nams's user avatar
  • 1
-1 votes
1 answer
14k views

Refused to display 'URL' in a frame because it set 'X-Frame-Options' to 'sameorigin'

Within the 'My Domain' settings - Authentication Configuration's I have added (as an example) https://www.salesforce.com/dreamforce/ to the Right Frame URL. When I go to our sandbox login page, on ...
h3110's user avatar
  • 77
0 votes
0 answers
114 views

Secure LWC embedded on Experience Cloud

I have an experience Cloud site that uses a custom LWC component. This LWC component allows for editing specific contact fields for the logged in user. Profiles or permission sets aren’t used to ...
Degmo Befada's user avatar
1 vote
1 answer
72 views

Site.login() URL is not working on production org

We have an Experience site with a custom Apex login controller. When a user logs in, the controller captures the URL from the PageReference returned by Site.login() and sends the login URL to the user ...
Will's user avatar
  • 449
0 votes
1 answer
154 views

How can I create a enhanced transaction security policy to allow only POST method in API event

I want to set some alerts and restrictions for API calls using Shield Event monitoring. I am not able to figure out how can I create real-time monitoring using Transaction security policy to allow ...
Mona's user avatar
  • 1
6 votes
3 answers
878 views

With USER_MODE - do we still need SOQL and DML libs?

As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
Robert Sösemann's user avatar
7 votes
1 answer
3k views

For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?

When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given ...
kennyc's user avatar
  • 307
0 votes
1 answer
131 views

When is the External Service Scan required in Salesforce Security Review?

I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
Manuel Moya's user avatar
-1 votes
1 answer
293 views

How to enable/disable button based on user edit access in LWC datatable?

I am building a Lightning Web Component (LWC) that retrieves data from Apex and displays it in a datatable. Currently, the LWC component retrieves all records from Apex, but I want to fetch that the ...
Akshay Gupta's user avatar

1
2 3 4 5
18