Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

User-invoked disabeling of an account to run in a flow for their specific public group

I'm really scratching my head on this one. I'm new to Salesforce (8 months) and I've created a flow to automate our AR process. We have 89 public groups that control privacy. Right now, the flow is ...
1 vote
1 answer
552 views

Lock a Field on a Record based off of Profile

I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
0 votes
0 answers
28 views

Create a report for an Org's Overall Security Settings

Frequently, there is a need to generate a report for internal Infor-Security Audit on the high level Security Setup for a Salesforce Org. Is there any available tools or methods to quickly create a ...
0 votes
1 answer
27 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
-1 votes
1 answer
30 views

SFDC's out-of-the-box email to case security standards

We are in the midst of HITRUST certification info-gathering and remediation steps, and because we have SFDC's out-of-the-box email to case as a communication tool, we are looking to understand its ...
0 votes
0 answers
41 views

Giving community users access to records via junction object

I have a junction object called Junction__c. It has Master-Detail to PersonAccount and another object called Mortgage__c. I have a checkbox on Junction__c called Access_Granted__c. When this checkbox ...
0 votes
1 answer
30 views

How can I stop Email Preview from executing API calls?

Trying to institute tokenized links in the emails that will allow users to sign-in to the company's website without having to enter credentials. Tokenized links are generated by the company backend on ...
0 votes
0 answers
16 views

Granular Control on Chatter Posts

I have a use case where we have a group of Profiles that need to have access to edit their Chatter Case comments for 24 hours and then those posts become locked for them and no longer editable. They ...
0 votes
2 answers
32 views

How to control edit access to Role?

I have a role Sales Manager. The sub roles of Sales Manager are Sales Rep A and Sales Rep B. The records created by Sales Rep A user and B user are seen by Sales Manager. It is done by Role level ...
4 votes
1 answer
3k views

Install for "All Users" vs "Admin Only" (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
0 votes
1 answer
39 views

Cannot create IsAccessible statement for User object

I'm trying to create this statement: if(User.sObjectType.getDescribe().isAccessible()){ User userData=[SELECT id, Profile.Name FROM User WHERE id=:user.id]; return userData.Profile....
0 votes
1 answer
50 views

Visualforce and LWC Security Concerns [closed]

I’m trying to find an example of security issues in VF or LWC. If that security vulnerability really exist in the code, and if that vulnerable code is deployed to a Salesforce prod org or Salesforce ...
1 vote
0 answers
34 views

"Nested" Named Credential Callout

I have a named credential, let's call it NC1, setup for a custom AWS endpoint. This works great using the endpoint and an access key. However, as part of the body of NC1, I need to send an auth ...
0 votes
1 answer
81 views

Establish a connection from Salesforce to VPN

Some of our API endpoints cannot be accessed from SFMC without connecting to the VPN network. We need to fetch information from these endpoints. Is VPN tunneling possible from SFMC? currently, it is ...
0 votes
0 answers
209 views

Opportunity Sharing Rule creation option not available

In one of my org I changed the OWD for Opportunity from Public Read Only to Private. However, I can't see the option to create a new sharing rule for Opportunity. What could be the possible reason for ...
5 votes
0 answers
529 views

"Force relogin after Login-As-User" - But why?

In our health check, it is noted that we do not have "Force relogin after Login-As-User" enabled. Per the documentation, I can see what this checkbox does - but there is not much documentation on why ...
0 votes
1 answer
77 views

Gave User Read Only Permission In Sharing Setting but Able to Edit Records when OWD is Private

I want a user to see all the records of Quote object of other users based on some criteria, I created a sharing rule on the opportunity to share records with that user and gave read-only permission ...
4 votes
2 answers
983 views

How can I encrypt a string in Apex in a way that an external system can decrypt using C#?

Our security team has found an issue in our lightning experience site where a link to an external system is adding the account # in the URL. That system is then using that account # to display data on ...
2 votes
2 answers
549 views

Inherited Sharing not respected in trigger context

I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
0 votes
0 answers
47 views

Allow only 1 profile to Merge Accounts

Use Case: Only users from a profile 'CSX' should have the ability to Merge Accounts. No matter who owns the Acount, when Accounts need to be merged only this profile can Merge the records. Security ...
0 votes
1 answer
977 views

Unable to Add quote line items : facing error insufficient priviledges

I am getting error "insufficient priviledeges while adding quote line item. Checked with permission setting for profile but still same. i have access to quote object. Got to the one point, when we ...
2 votes
1 answer
199 views

Role for Inactive users

In our salesforce instance the roles were cleaned up and as a result some of the inactive user's role were deleted, now those inactive users owned records are not pulled in reports as the owner of ...
6 votes
1 answer
2k views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
2 votes
2 answers
1k views

Re-enabling the ability to impersonate External Users via "Log in to Experience as User" button (Spring 21)

Some Platform Users in my org used to be able to impersonate Community (now "Experience") users from the Contact record by using the "Log in to Community as User" button. After ...
0 votes
2 answers
64 views

SalesForce Workbench Architecture

We are performing a security review of the WorkBench tool before allowing external consultants access to our Salesforce organization for viewing the structure and relationships to develop reports. I ...
2 votes
2 answers
168 views

Lightning Web Security breaks LWC with svg use tag

When there is a LWC using svg use tag like suggested on Lightning design system site and Lightning Web Security is turned on (the setting Use Lightning Web Security for Lightning web components on ...
1 vote
3 answers
1k views

How to enable Verification Code emails for Customer Community users?

When you log in to Salesforce for the first time from a new computer (or new browser), you are asked to provide a Verification Code which is emailed (or texted) to you, as an additional security ...
0 votes
1 answer
3k views

gets “System.QueryException: Insufficient permissions: secure query included inaccessible field” error

We have a query that is executed by an “experience site/community” user. The user has “Partner Community” license and “Partner Community User” profile. This user executes code containing the following ...
2 votes
1 answer
59 views

How often does Salesforce change the keys at https://login.salesforce.com/id/keys?

How often does Salesforce change the keys change at https://login.salesforce.com/id/keys ? Context A client wants to verify the JWT signature generated for Salesforce's OpenID Connect token However, ...
0 votes
0 answers
30 views

Save Custom logout url through Apex code

In Setup >> Security Controls >> Session Settings >> Logout Page Settings. System Admin can define Logout Page URL. Can we set this via Apex Code or Metadata API ?
0 votes
1 answer
535 views

Disabling download attachments to guest users

I would like to disable the possibility to download and read attachments to guest users of my community by requesting them from https://<salesforce-url>/community/servlet/servlet.FileDownload?...
3 votes
2 answers
1k views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
3 votes
2 answers
5k views

Lock sessions to the IP address from which they originated

After enabling "Lock sessions to the IP address from which they originated" still able to login to workbench in same session and callouts are also working. Didn't understand the working of it.How does ...
10 votes
2 answers
28k views

How to use the escapeSingleQuotes method?

I'm trying to use this method in a dynamic SOQL query. Follow the sample code: public static String getRowById(String sobjName, id id) { String query = 'SELECT '; Map<String, ...
1 vote
2 answers
2k views

Check if users email has been verified?

When the users email address is changed an email is sent to the user asking them to verify the change of the email. The user then clicks on the link and confirms the email change. Is there anywhere ...
1 vote
1 answer
37 views

What permissions on a profile/permission set should be considered "privileged user" or "system admin" access?

I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because ...
0 votes
2 answers
92 views

Salesforce Backup Process

I would like to be informed about Salesforce Backup Process (Security Management). I would like to know more about the Standard Recovery Process if any. How often is the Salesforce backup taken? ...
2 votes
1 answer
1k views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
1 vote
1 answer
21 views

How is attachment access controlled by record level

By looking at the permission set and profile metadata files, I don't see a place defining the access to contentDocument or ContentVersion so I originally assumed it should be controlled by parent. ...
1 vote
1 answer
25 views

API Enabled User Use Which Sharing ? Extenal Default or Internal

I am making a user API Enabled. By turning ON the permission 'API Enabled'. What I am trying to figure out is, when this user is accessing data from salesforce with an external application. Which ...
5 votes
4 answers
543 views

How to permanently get rid of sandbox new/refresh email-address pollution with "@example.com"

When you create/refresh a Sandbox, all (but the refreshing) users email addresses get crippled with a nice "example.com". Using security codes via email, this basically breaks the possibility for ...
6 votes
2 answers
2k views

Prevent Username from being logged into multiple sessions and/or IP addresses Concurrently

Has anyone fielded a request to prevent a username from logging into multiple sessions at once? The problem is that currently Salesforce does not have declarative way of preventing logins, of the ...
0 votes
2 answers
406 views

Grant Access Using Hierarchies

If the OWD of a custom object is Private and Grant Access Using Hierarchy is enabled, then whether the user in the higher hierarchy always has the edit, read, delete access on the records which is ...
-1 votes
1 answer
37 views

Security setting on report type

How can I allow reporting on only one report type(there is only one custom object in this report type) for a particular profile in salesforce? All other report types should be hidden/not selectable by ...
0 votes
0 answers
28 views

Enforce CRUD on single record DML statement

As the title suggests I am trying to enforce CRUD on a DML statement for a single record. I see the stripInaccessible() method takes in a list of sObjects. Is there an equivalent method for a single ...
27 votes
9 answers
18k views

Can I compare Profiles?

We have many profiles in our org, and I suspect that some of them are redundant because the person who originally set them up didn't seem to understand the purpose of Profiles (confusion with Roles, ...
0 votes
0 answers
62 views

Not Able To Access Records In Role Hierarchy

I am a salesforce developer but new to admin. Tring to understand security settings using role hierarchy and having an issue or confusion here. I'll try to explain this below. I have two roles in the ...
0 votes
2 answers
616 views

Not able to find reset token option in sandbox instance

I am not able to find the Reset Security token Option under the settings option in my partial sandbox instance. Can someone please let me know how to find it. Or if I am missing out on anything. I am ...
4 votes
2 answers
182 views

LWS - Apparent difference in behavior using data returned from Apex call

Prior to enabling LWS in Spring '22 we were able to successfully 'modify' objects returned from an Apex Call. After enabling LWS we cannot modify the data. Allow me to give an example. Below is some '...
0 votes
0 answers
32 views

Visualforce Public Form DoS Security

I have created a public registration form for clients. No login/credentials are required to submit the form. It is reachable via a custom url of this format: my-custom-subdomain.force.com. It is built ...

1
2 3 4 5
17