Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

214 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11
votes
0answers
116 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
10
votes
0answers
198 views

Font Awesome fonts are not being loaded after "Enable Secure Static Resources" activated for testing

Recently I have encountered the feature "Enable Secure Static Resources" on the release update (that was already being postponed as I am writing this) and read this question talking about it ...
8
votes
0answers
110 views

Securely logging out as any user

When using the functionality where the system admin can log in as any user, I noticed that during log-out, there are two different responses that I can get back from /secur/logout.jsp. The most common ...
7
votes
0answers
93 views

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

We are looking at setting up our Salesforce org as a public and secure endpoint target for a 3rd party application (Housecall Pro) which will be sending us webhook calls. The only rub is they cannot ...
6
votes
1answer
957 views

Outbound Message Security and Validation

I am investigating the security implications of using Salesforce's Outbound Messages. I have reviewed the documentation about security for Outbound Messages. Does Salesforce have a way of ...
5
votes
1answer
1k views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
5
votes
1answer
420 views

Insufficient Privileges for Public Group Memberships Page

A user is a part of multiple public groups in Salesforce and has a custom profile. When the user navigates to the personal information page and clicks on the 'Go To List' link available under the '...
4
votes
0answers
414 views

"Force relogin after Login-As-User" - But why?

In our health check, it is noted that we do not have "Force relogin after Login-As-User" enabled. Per the documentation, I can see what this checkbox does - but there is not much documentation on why ...
4
votes
1answer
53 views

How to check from Apex code if custom setting is protected?

The question is simple: Is there any way to figure out from Apex code if custom settings is marked as protected or not? Looking through DescribeSObjectResult cannot find any single method related to ...
4
votes
0answers
75 views

Enable Apex Classes - Sometimes Only Global, Sometimes Includes Public

I have a managed package that I distribute to clients and I'm running into a curious situation trying to help one install. I have noticed that in the Enable Apex Classes for their System Administrator ...
4
votes
0answers
66 views

Visualforce Remote Objects Returning Empty Objects

I've got a remote object query operation that's failing in our managed package in a particular client's org. Essentially it queries an object with some filters based on the date, and it's returning ...
4
votes
0answers
29 views

How to help portal/community users with out TLS 1.1 enabled?

Salesforce will be phasing out support for TLS 1.0 over the coming year. Browsers will need TLS 1.1 or higher to connect to Salesforce. Users of Internet Explorer v, 8, 9, & 10 on Windows 7 or v. ...
4
votes
0answers
752 views

How to control custom object through territory management?

I have 2 custom objects and tabs. Accounts and Users are assigned manually in my org. How to I control their visibility/security according to territories? Are there any samples that I refer to? That ...
4
votes
0answers
2k views

How to resolve system.security.NoAccessException error

I am getting this exception. system.security.NoAccessException: Update access denied for Custom_Object__c Whats the reason for this? why i am getting this error. I have given all profile level, ...
3
votes
1answer
53 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
3
votes
0answers
100 views

Apex Row-Level Security is not applied to OwnerId field

It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement. public with sharing class ...
3
votes
0answers
80 views

How to enable CORS in a community

Hi i've recently encountered a problem where i needed CORS to be enabled for some domains. In the Salesforce Org i can specify CORS to be enabled for some domains. The problem lies with community ...
3
votes
1answer
91 views

Transaction Security is not available in Scratch Org

How am I able to turn on the visibility for transaction security? I am trying to test an apex class that implements TxnSecurity.PolicyCondition and according to this article to be able to see these ...
3
votes
0answers
85 views

Standard User with "Modify Metadata" fails to create active Picklist Value

What is failing here perfectly works for a SysAdmin user. I have a StandardUser with a permission set which grants him ModifyMetadata and calling this code creates the Picklist Value but leaves it ...
3
votes
0answers
140 views

Password policies remain after deleting profile?

I deleted a profile via the Metadata API, and it did not delete its associated password policies. I cannot find the policies anywhere in the UI, but when I pull from production (or any sandbox ...
3
votes
0answers
416 views

Trying to call API through Apex with custom security certificate but getting CalloutException

I'm trying to use Apex to call some API endpoints to do some validation for my company. There are some specific properties of these APIs that make it a bit tricky: The APIs are hosted on self-...
3
votes
0answers
194 views

System Authenticated Redirection - redirecting to login page over and over

I'm trying to set up a 'System Authenticated Redirection' microsite in Marketing Cloud. Even though I'm logged in, it keeps redirecting me to the login page. I enter my details over and over again, ...
3
votes
0answers
1k views

To enable Require secure connections (HTTPS) for all third-party domains

I have to increase the security level of my org. I know that if I activate "Require Secure Connections (https) for all third-party domains" I may have problems with pre-existing integrations. How can ...
3
votes
1answer
212 views

Why I need "Connect Salesforce Authenticator" during activation of "myDomain"?

I'm working on a Sandbox and I need to use Custom Lightning Components. Therefore I need to activate the myDomain feature. I've done that several times before, but today I get stuck in the process. ...
3
votes
1answer
406 views

Marketing Cloud SQL Injection?

I had a question come up that seemed a bit ridiculous at first, but has got me wondering. Is it possible to run any sort of script or SQL injection equivalency on forms that are configured to direct ...
3
votes
0answers
272 views

Can public force.com sites be accessed from "restricted countries"

As from the summer 15 release, Salesforce started blocking users from logging in from "restricted countries" like Cuba and Iran. (http://trust.salesforce.com/trust/blocked) Does this also apply to ...
3
votes
0answers
98 views

Permission Set issue

I am writing to you in order to describe permission set issue that i don't know how to figure out. I want to give an access to part of financial force package (possibility to assign current company ...
3
votes
1answer
265 views

Does OAuth token (from mobile SDK) still work in local browser?

I'm working on the Mobile app development. Here is my issue: We have got a token through the OAuth flow in App using SDK. There is a link in app named "user info", user tap that link and open a local ...
2
votes
1answer
60 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error thrown in random places

Recently I've started getting error message: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Access to entity 'AIInsightValue'...
2
votes
0answers
22 views

Salesforce security issue - Account owner's role of community user is given access to accounts the community user is linked to via cases

We have a security requirement where certain accounts should only be visible to a certain public group. To enable this we have a checkbox on the account and set our OWD to private. Any account with ...
2
votes
0answers
110 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
2
votes
0answers
2k views

Install for "All Users" vs "Admin Only" (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
2
votes
0answers
204 views

Import CA-Signed Certificate from One Org into Another via MetadataAPI

I am trying to automate the set up of some of my lower sandboxes. In my SandboxPostCopy class, I'm using the FinancialForce MetadataAPI wrapper MetadataService to query and upsert a certificate. (...
2
votes
0answers
59 views

Guest User Create and Update permission after Spring '20

During Spring '20 Salesforce is deploying a set of security updates regarding the Guest User profile and its capabilities, mainly limiting it from being able to create and update records. We have ...
2
votes
0answers
68 views

Schema.sObjectType.Task.fields.Subject.isUpdateable() is false in force.com site

We have managed a package where we are using apexrest through force.com site to update the task records. This works fine unless we add security enforce through apex getDescribe() like, Schema....
2
votes
1answer
692 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
2
votes
0answers
81 views

Using Protected Component for "Secret Protection" with Unlocked Packages

How do "Protected Components" (Custom Settings or Custom Metadata) function when installed from an Unlocked Package. I was hoping that I would be able to use as "Protected (Managed)" to store "...
2
votes
1answer
785 views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
2
votes
0answers
713 views

Collect Tracking Code Security

Question about Personalization Builder - Collect Tracking Security: When users go on a webpage with collect tracking code implemented, they send an invisible tracking pixel via the basic javascript ...
2
votes
0answers
90 views

Crypto sign string using DSA private key in Salesforce

Colleagues, I'm doing integration using REST API with a service that requires a string signed by private key which uses DSA algorithm. The problem is in APEX Crypto class does not support DSA keys (...
2
votes
0answers
245 views

Getting insufficient Privileges error on custom field only when in inputField or outputField

I have a custom field on the Service Contract that I am referencing on a Visualforce Page, which is getting this Insufficient Privileges error: Insufficient Privileges You do not have the level of ...
2
votes
0answers
41 views

Enabling Platform Encryption on two packages

We have two managed packages and one is the base package for the other and contains all the fields (no fields on the second package). We want to enable platform encryption on the fields of the base ...
2
votes
0answers
202 views

Security Implications with Production ID and Organization ID

Is there any issue with having your organization ID and your production ID seen in links? I am having to upload image files as Documents into my salesforce org and then send the image through ...
2
votes
0answers
43 views

Users can edit anything when I use a VF page as an Edit override

I want to allow my users to only edit records they own with two objects which are in a Master/Detail setup. I have the following setup : Master Object : OWD : Public Read Only User's Permission Set ...
2
votes
0answers
158 views

OpportunityContactRole security

In a nutshell, how from the REST API (outside the Apex wall here), can I tell I can create/edit/remove an OpportunityContactRole from scratch. Part I of the answer is I believe the ...
2
votes
1answer
1k views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
2
votes
0answers
36 views

Require login on each access of Salesforce1 app

I would like to require our users to have to enter their Salesforce password each time (or after a certain time of inactivity) they access the Salesforce1 app on their IOS and Android devices. The ...
2
votes
0answers
159 views

Role for Inactive users

In our salesforce instance the roles were cleaned up and as a result some of the inactive user's role were deleted, now those inactive users owned records are not pulled in reports as the owner of ...
2
votes
0answers
547 views

Permission Customize Application depends on permission(s):Manage Translation

I am getting above problem when granting modify All permission in permission set . How i can solve above problem. what is wrong with me? Thanks in Advance.
2
votes
0answers
3k views

Why might a certificate import fail, when uploading a certificate not created from a Salesforce-generated Certificate Signing Request?

I've been given two X509 certificates to upload into an org for use in SSO (one for signing, one for decrypting), but I can't seem to upload either of them successfully. As I've been given the ...

1
2 3 4 5