Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
2
votes
1answer
785 views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
0
votes
1answer
713 views

Hide a Lead in sfdc based on lead status

I got a requirement like want to hide leads in my org based on the lead status.i have a value in status field called customer.so,when user selects customer in status field the lead had to be hidden ...
-3
votes
1answer
51 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
1
vote
3answers
357 views

How to temporarily Disable Access for Entire Org?

How to temporarily Disable Access for Entire Org? For all Internal and/or All External users.
3
votes
5answers
9k views

Track Salesforce Report Usage

For orgs with sensitive data reporting can be a double-edged sword in that it can make it easy for disgruntled employees to walk away with a lot of data. We'd like to try and limit this by monitoring ...
3
votes
1answer
53 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
0
votes
0answers
27 views

Is Salesforce MFA Built In Authenticator alone enough? [closed]

Does Built-In Authenticator (Beta) alone satisfies MFA requirement set by Salesforce ? or we need to setup other mechanism also like Salesforce Authenticator ?
0
votes
2answers
150 views

Not able to find reset token option in sandbox instance

I am not able to find the Reset Security token Option under the settings option in my partial sandbox instance. Can someone please let me know how to find it. Or if I am missing out on anything. I am ...
45
votes
4answers
29k views

Can I get my security token without having to reset it?

I need to get a user's security token but there are other things currently using it so I don't really want to reset it. Is there any way to retrieve this without having to reset it?
9
votes
1answer
14k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
5
votes
1answer
62 views

How to deal with the security of odd standard fields?

We are using the Security.stripInaccessible method to identify fields that don't have the proper DML permission to insert, update etc. It works good for the most part but it gives us some false ...
0
votes
0answers
22 views

Impact of "Enable clickjack protection for customer VisualForce pages with standard headers"

Can anyone tell me what could be the impact in Org if Admin enables session setting "Enable clickjack protection for customer VisualForce pages with standard headers" I totally understand ...
-1
votes
2answers
42 views

Best Practices for Storing API Key?

I have a Lightning Web Component that makes a fetch() request straight from the component's JavaScript. For testing and development I've simply stored the API key as a variable, but I'd like to back ...
0
votes
1answer
776 views

Unable to Add quote line items : facing error insufficient priviledges

I am getting error "insufficient priviledeges while adding quote line item. Checked with permission setting for profile but still same. i have access to quote object. Got to the one point, when we ...
0
votes
1answer
31 views

Is it ok to store a bearer token in a custom field in the user object [closed]

I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. ...
5
votes
1answer
81 views

Is there a security hole in Salesforce's documentation?

I was looking at Salesforce's documentation for implementing an OAuth callback and I noticed they are accepting a "sfdc_community_url" from the client, which should normally only ever be a ...
5
votes
1answer
1k views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
0
votes
2answers
47 views

Salesforce Backup Process

I would like to be informed about Salesforce Backup Process (Security Management). I would like to know more about the Standard Recovery Process if any. How often is the Salesforce backup taken? ...
0
votes
0answers
14 views

Security in Cloudpages when using Java Script flow frame-work to call app and customer can input their details on that app called by Javascript

We are developing a cloudpage (Landing page) in marketing cloud and on that landingpage there is a button called "Get Started" so once customers land to this cloudpage they can click on &...
9
votes
1answer
442 views

Can API access be limited to only via Apex classes?

We are building a product that offers two routes to the back-end data: JSON calls to @RestResource Apex class APIs LWC calls to @AuraEnabled Apex classes Is there a profile setup that keeps these ...
0
votes
0answers
25 views

Unable to disable XSS-Protection

I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
0
votes
0answers
34 views

REST API. Sending sensitive data in URL . Security issue

I have a security issue. I built an app that interacts with WordPress and its plugins via REST api, gets and posts some info and syncs it with Salesforce data. I have apex classes that perform HTTP ...
0
votes
1answer
22 views

Can I view a record if that record type / page layout is not assigned to me in salesforce

If I have access to 2 record types of an object and someone who has an access to a 3rd record type assignes me that record (which was created using that 3rd record type), will I be able to view it?
1
vote
3answers
1k views

How to enable Verification Code emails for Customer Community users?

When you log in to Salesforce for the first time from a new computer (or new browser), you are asked to provide a Verification Code which is emailed (or texted) to you, as an additional security ...
0
votes
1answer
24 views

Auth Provider configured as High Assurance continues to prompt users for MFA?

Our users currently log into our org using their salesforce username and password credentials along with their registered verification method of choice for Salesforce's own MFA prompt. We're now in ...
0
votes
2answers
45 views

What is isCreatable and isUpdateable for FIELDS in GUI

Where can I find and enforce "CREATABLE" and "UPDATEABLE" options for fields? Because, i am able to check the permissions in Apex(below statements) whereas, not able to find what ...
1
vote
0answers
33 views

Can RSA SecurID be used as Salesforce MFA?

Next year MFA will be required (Salesforce MFA Doc) and the customer has RSA SecurID as 2FA for other applications, We would like to know if we can use SecurID as a third-party authenticator app for ...
0
votes
0answers
10 views

How to provide CRUD permissions over groupmember object

For a non-admin user(Salesforce Platform license) with minimal/specific permissions, we want user to access groupmember record programmatically, for CRUD operations (especially Delete). However, while ...
0
votes
0answers
16 views

Salesforce implicit sharing - does access to account records via implicit sharing open up access to contact records as well?

If OWD is set to private and access to case record opens up the access to account Record via implicit sharing, will that also open up the read only access to contacts related to those accounts? ...
0
votes
0answers
8 views

Why can the member of a delegated group assign profiles not listed as assignable?

Two sandboxes are set up with the same assignable profiles in a delegated group under Delegated Administration. In one sandbox, users can only set up new users with one of the assignable profiles ...
1
vote
2answers
731 views

Welcome Email not getting sent to community users on register

I have run into an issue where if I am unchecking a checkbox: 'Let guest users see other members of this community' under general setting in Preferences. If the check box is checked, welcome emails ...
2
votes
1answer
60 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error thrown in random places

Recently I've started getting error message: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Access to entity 'AIInsightValue'...
2
votes
1answer
1k views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
5
votes
2answers
2k views

Does with sharing enforce OLS/FLS?

I am really confused about this one. I have done my share of research. In the documentation, it has been mentioned that with sharing keyword is used to enforce sharing rules for the current user. It ...
27
votes
9answers
15k views

Can I compare Profiles?

We have many profiles in our org, and I suspect that some of them are redundant because the person who originally set them up didn't seem to understand the purpose of Profiles (confusion with Roles, ...
2
votes
1answer
48 views

Marketing Cloud SSL DIY Setup Cheaper?

I'm a marketing cloud and ssl newbie, so forgive this newb question. So, we have 2 business units with SAP needing 4 SSL Certificate, I contacted our account exec to get a quote. The total was ($6.5k) ...
0
votes
0answers
19 views

Visual Force expose on External Site - Manage access

I have a need to create a visual force page that will be accessible on an external web site, it will be displayed in an Iframe. The page will be accessible only for specific web site user after login. ...
3
votes
3answers
4k views

How to pass Schema.SObjectType to a class method as an argument?

In an effort to write reusable code, I am trying to move my field-level security check code into a common class/methods. Because the Schema.SObjectType is dynamic, I am looking for a way to pass ...
0
votes
1answer
195 views

Should Named Credentials be used to store an API Callout Bearer Token?

Problem I have a straightforward REST API callout in apex. request.setEndpoint('https://api.websitename.com'); request.setMethod('GET'); request.setHeader('Authorization','Bearer ...
0
votes
1answer
27 views

How to restrict users to access accounts they do not own associated with cases they do own

We have two companies with their seperate roles hierarchy under same organisation. The hierarchy is same for both companies CompanyA Manager - CompanyA Processor - .. CompanyB Manager - CompanyB ...
2
votes
0answers
22 views

Salesforce security issue - Account owner's role of community user is given access to accounts the community user is linked to via cases

We have a security requirement where certain accounts should only be visible to a certain public group. To enable this we have a checkbox on the account and set our OWD to private. Any account with ...
3
votes
1answer
101 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
0
votes
0answers
19 views

Marketing Cloud SSO Config Failure - ReplyURL mismatch

I did all the configurations as mentioned in the steps here: Salesforce Marketing Cloud - Azure SSO Implementation I am redirected to IdP login screen, when I load the Marketing Cloud SP Url. But then ...
0
votes
0answers
18 views

SSH Private Key is not accessible file Transfer Activity

I have a pair of SSH keys from my customer and I want to update them into Salesforce to use for Encryption and Decryption. I have no problems with an encryption key, it works just fine. But when I am ...
1
vote
1answer
250 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
14
votes
2answers
3k views

Does Salesforce have an Antivirus feature?

Is there any way to integrate Antivirus in Salesforce, or does this already exist? Additionally, I would like to also have realtime URL scanning of malicious HTML documents and websites. Key ...
3
votes
3answers
109 views

Is there a working Desktop Authenticator App for MFA? (with no mobile device involved)

I have very mixed feelings towards the enforcement of MFA by Salesforce, which as a consequence enforces the usage of authenticator apps. I have over 400 developer orgs to deal with. I have to login ...
2
votes
1answer
692 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
0
votes
1answer
75 views

Whitelisting Salesforce IP addresses

We want to integrate Salesforce with one of our in-house applications. However, my networking team does not want to open the IP address (128.245.0.0/16 means 16,000 IPs) . How can we restrict the IP ...
7
votes
0answers
93 views

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

We are looking at setting up our Salesforce org as a public and secure endpoint target for a 3rd party application (Housecall Pro) which will be sending us webhook calls. The only rub is they cannot ...

1
2 3 4 5
17