Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
73
votes
7answers
12k views

Apex static code analysis

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue ...
58
votes
8answers
42k views

What is the best way to deploy profiles in Salesforce? (especially system admin)

What is the best way to deploy profiles in Salesforce? I have a system admin profile with access given to the objects that i have created in my sandbox. I have about 1000 fields across these objects. ...
6
votes
1answer
2k views

Securely Storing a static API secret/key in a Salesforce app

I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an ...
9
votes
3answers
2k views

What are permissions are needed to upload a file via a public Salesforce community page?

I would like to be able to upload files using <lightning:fileUpload which is on a public community page. The community is using template: Customer Account Portal. The files would get attached to ...
9
votes
1answer
9k views

Basic Http Authentication

I am writing a web service for which sends a SOAP payload as its body. In order to access the 3rd party server, I need an authenticated user. I am using Basic Http authentication for that purpose. ...
4
votes
1answer
3k views

Securing Sensitive Information with Salesforce Best Practices

I am working on an org in unlimited edition. Most of the 20 schools we are creating online applications for have separate banks. I am new to Salesforce and wondering what the best practice is for ...
24
votes
2answers
14k views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
22
votes
5answers
11k views

Can web-to-lead be protected from spammers without additional server side processing?

The default web-to-lead functionality that Salesforce provides makes it really easy to drop an HTML form onto any web page and submit leads straight into a Salesforce Org. E.g. <form action="...
44
votes
4answers
27k views

Can I get my security token without having to reset it?

I need to get a user's security token but there are other things currently using it so I don't really want to reset it. Is there any way to retrieve this without having to reset it?
10
votes
2answers
3k views

How to set public inline images in Knowledge Base Article

Background I'm developing an standard FAQ using Knowledge Base Articles. I've defined an Article Type FAQ which contains a Rich Text field called "Answer". The FAQ articles are exposed to an ...
8
votes
1answer
9k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
2
votes
1answer
1k views

Root cause for “Entity is not org-accessible” for sharing object?

Not able to find Sharing object for custom object Apttus_Proposal__Proposal__Share; giving me error while List<Apttus__APTS_Agreement__share> st = new List<Apttus__APTS_Agreement__c>();
9
votes
1answer
17k views

How to use the escapeSingleQuotes method?

I'm trying to use this method in a dynamic SOQL query. Follow the sample code: public static String getRowById(String sobjName, id id) { String query = 'SELECT '; Map<String, ...
10
votes
2answers
2k views

Javascript Remoting CSRF

A third party security review is suggesting I need to add CSRF prevention to my javascript remoting calls. I'm not sure what is the best way to proceed. Switching to an apex:form to utilize built in ...
8
votes
4answers
15k views

What overrides a profile?

I am confused about the hierarchy of settings 1) I have a profile A and it has a read only access. I have a permission set specific to an user and the permission set grants the user access to edit ...
9
votes
2answers
2k views

Newbie Q: Is “Field Level Security” the same as “Field Accessibility”?

There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
3
votes
2answers
1k views

Cryptoclass Throws Error. Invalid private key. Must be 16 bytes. Sending 16 characters long key

key__c :- abcdefghijklmnop public static String decrypt(String data) { EncryptionSettings__c settings = EncryptionSettings__c.getOrgDefaults(); if (settings.key__c == null) { throw ...
2
votes
3answers
5k views

Can we deploy PROFILES alone from one sandbox to another?

Can we deploy only profiles from one sandbox to another? Thanks
5
votes
1answer
810 views

Edit Insufficient Privileges Page

Is there any way to gain access to the standard "Insufficient Privileges" page that everyone knows and loves(hates), in order to edit/replace it with something else? I imagine something along the ...
3
votes
1answer
2k views

invalid security token

Hi we were given an ExactTarget php application to port from an older Magento installation to a new Magento installation. This code is based on the ExactTargetSoapClient, soap-wsse.php and xmlseclibs....
2
votes
1answer
136 views

Want to prevent a user to access other user cases

I Want to prevernt user to access other user cases in search and report as well in salesforce, when user at same level in role hierarchy. My Organization-Wide Defaults setting is following Case: ...
1
vote
2answers
2k views

Hide a Field From ONE User

Scenario: If I had a Custom Profile / Standard Profile, say Sales,and I have 50 Users assigned to the same Profile and had same Permission / Access on a particular object (Could be Standard or Custom ...
15
votes
4answers
7k views

Giving users access to a specific custom setting without granting them Customize Application access

I'm working on a VF page to give some users access to certain custom settings without given them the entire Customize Application access. Is there anyway to edit and commit data into the system as an ...
15
votes
2answers
4k views

are Triggers (and their delegated classes) or Batch affected by sharing?

I understand with sharing classes run in User Mode, meaning they respect permissions, field-level security and sharing rules of the current user. I understand without sharing classes run in System ...
12
votes
2answers
7k views

Deploying Profiles / Permission Sets that include object & field permissions for Managed Objects

Anyone know if it's possible to deploy profiles/permission sets via Eclipse or an Unmanaged Package that contain object & field permissions for 3rd party managed objects? I'm trying to deploy a ...
8
votes
1answer
2k views

Critical Update “Serve Static Resources from the Visualforce Domain” still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
10
votes
2answers
2k views

Deploying From Sandbox (Enterprise) - loss of permissions, field security, etc

I have been reading up on this particular area of concern and from what I'm reading, it sounds like the solution I've been creating for the past two weeks is going to be a nuisance to deploy from ...
9
votes
2answers
1k views

Is encrypting passwords in protected custom settings a security requirement?

Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain ...
5
votes
1answer
208 views

Determine org. wide security on an object

I'm trying to determine (in APEX) what the security level is of a custom sObject (for a UI) For example: mysObject__c (Public Read Only, Private, etc.) I know it's possible to test the by inserting ...
1
vote
1answer
313 views

Related to Digital signiature

Something related to Digital signature if we have a doc in sales-force and needs to be digitally signed, which involves digital certificates.. and how we can use crypto class of apex in this. also ...
20
votes
5answers
3k views

Is it possible to have different password policies for different users?

Can I have a certain profile to have a password change policy of 1 year, and other profiles (or the rest) as change every 60 days? I know you can set it for the entire organization, I need to specify ...
15
votes
4answers
2k views

Twilio Integration and SSLv3 POODLE Vulnerability

I have an existing integration with Twilio that works great - Twilio posts a message to a custom SFDC REST endpoint, and we can generate a new SMS message by calling out to the standard Twilio REST ...
14
votes
3answers
4k views

How do I find out if a user has access to a visualforce page through apex?

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown. Sometimes the logged in user will ...
8
votes
1answer
623 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
8
votes
2answers
248 views

PIN Security for a Force.com Mobile SDK App

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown ...
4
votes
1answer
3k views

system.security.NoAccessException: Update access denied for RecordType

I have a Visualforce Page that uses a standard controller (Opportunity) and an extension. In the extension I have a method that saves updates to the opportunity and a related contact. The extension is ...
4
votes
2answers
6k views

X-Frame option set to deny in I-Frame inside salesforce

I am struggling with a error when i am trying to display a page of external application in an i-frame using tag due to an error X-frame Options Set to Deny .I have attached the screenshot of issue i ...
3
votes
1answer
140 views

What is the value of using an OAuth flow for your own external systems

I'd like to begin by saying that I'm not talking about systems outside of a given company. I understand how OAuth is important for an application like workbench, where you don't know who the people ...
3
votes
1answer
1k views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
1
vote
0answers
202 views

Where I can store access and secret keys for callouts to AWS SQS service? Should I use Named Credentials or other means suit better for this case

This question has an answer to how to send request to Amazon SQS service from Apex. However, I am concerned that we have to expose access and secret keys in the code. Is this possible to use Named ...
1
vote
1answer
359 views

Security scanner: enforcing CRUD. Auto scanner reported issue

I have a question here regarding to Security scan: enforcing CRUD. For the example case deletion, but we also have problems with update and creation. Before I delete a record, I apply deletable check ...
0
votes
1answer
393 views

Refused to display 'https://www.salesforce.com/de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

I created VF page (or also to see the VF page inside a lightning component). I added an apex iframe with src="https://www.salesforce.com/de/" (or any other source) from salesforce apex iframe guide....
14
votes
1answer
395 views

Any docs on the permissions of the special InstallHandler package user?

InstallHandler is the interface you implement for a post-install script in a managed package. Per the docs: It runs as a special system user that represents your package, so all operations ...
9
votes
1answer
2k views

Use-Case for Encrypted Custom Fields and why are they rendered as input type=“text” and not as type=“password” on standard UI?

Can't understand why Encrypted Custom Fields are not rendered as type="password" on the standard UI. The first time you input or later if you change the content, it's just plain text. If you come back ...
9
votes
3answers
3k views

Making a public read/write record private

Disclaimer! I have searched for a result to this question on the web with no success therefore I need someone with expertise to review it and provide an answer. I use a public read/write OWD model on ...
7
votes
7answers
688 views

How to detect and block visual force page from scraping?

We are considering developing a new version of our website (where our customers can purchase and manage certain types of content) on the force.com platform. Looking into the impact of governor limits ...
6
votes
1answer
2k views

Sharing rules on Opportunities

How do the Sharing rules on Accounts and other objects where Opps are a child impact sharing rules?
6
votes
1answer
2k views

How to avoid security risks with escape=“False” in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
5
votes
1answer
2k views

Why are there 3 functions to encode in Visualforce?

I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks. To quote from the module: ...
5
votes
2answers
1k views

Is record level security top down or bottom up?

I was in a meeting today, and I was explaining the security model for some new objects. I was saying that we're set the Org wide defaults as private and open up record access by sharing rules and role ...