Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

stripinaccessible stripping fields for system administrator

I have a generic function to validate CRUD before DML which uses stripInaccessible(). public static SObjectAccessDecision validateCRUD(AccessType access, List<SObject> records, Boolean ...
2
votes
1answer
17 views

Tightening security around Javascript Remoting from Visualforce

We have a community portal built off of Visualforce pages and on those pages we do a lot of Javascript Remoting. Due to the complexity of our org, most of the Apex classes holding these remote methods ...
2
votes
1answer
27 views

Using isSet() vs getRemovedFields() to identify inaccessible fields after stripInaccessible()

I am wondering is there a difference between isSet() and getRemovedFields() to identify inaccessible fields that were removed by the stripInaccessible() method. From the official documentation Enforce ...
0
votes
0answers
15 views

Help with records not displaying on Force.com site

I've been building a Salesforce Site but am having trouble getting records to display on the page. I am using a specific Visualforce page as the homepage and can get the records to display fine when I ...
0
votes
1answer
19 views

use post requests for cross-domain sessions - session setting

I have enabled this session setting in my sandbox org. I did not see any difference interms of impacts to my system.which areas it will affect our system What i need to test before moving it to the ...
2
votes
1answer
80 views

What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent?

This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present ...
3
votes
1answer
701 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
0
votes
0answers
14 views

How to share parent records with a community user

When I create junction object with two parent objects I need to share parent record of this junction record with community user. How can I achieve this without Apex Share which enabled for Customer ...
1
vote
1answer
38 views

Summer 20 Release Guest Site - allow create custom object

We have a force.com site that has numerous VF pages to create a custom object. The Summer 20 release report says that we need to / will be forced to shut down access. I see that one can create sharing ...
2
votes
2answers
136 views

Inherited Sharing not respected in trigger context

I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
2
votes
0answers
86 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
0
votes
1answer
751 views

Using without sharing with customer community - can't create account

It looks like customer community users can't create Account records because there is no create option in object settings for a customer community profile. I thought that I could get around this if ...
2
votes
1answer
589 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
2
votes
1answer
397 views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
1
vote
1answer
29 views

How quickly are updates to Custom Metadata Types committed?

In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/...
0
votes
0answers
81 views

Auth Provider with per-user Named Credential

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
0
votes
1answer
27 views

Lock a Field on a Record based off of Profile

I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
0
votes
0answers
22 views

Set-up a File Location that is not on a standard port

According to documentation Marketing Cloud will only allow connections on the stardard 21/22 ports. The client has a security policy that doesn't allow access to standard ports. https://help....
4
votes
1answer
369 views

How to troubleshoot Exception thrown when using WITH SECURITY_ENFORCED

I've added the WITH SECURITY_ENFORCED clause to my SOQL queries. I'm testing them with a user who has a permission set that grants all object permissions (read, create, etc.), and also has read and ...
1
vote
2answers
573 views

“You do not have access to the Apex class named …”: cannot find the cause

I have developed a Lightning Web Component in a sandbox, consisting of HTML, JS, some actions and a few Apex classes. I have tested this as sysadmin and as another non-sysadmin user. No problems. ...
2
votes
2answers
272 views

What is the impact of enabling the critical update 'Route My Domains Through Salesforce Edge'?

Based on the documentation, it'll use Machine Learning to improve connectivity and performance --> so is this going to switch Salesforce login by default to Edge?
0
votes
2answers
25 views

How can I find the Secure URL for the public site by Apex?

We are using the following code to find the Secure URL for the public site by Apex List<String> siteFullUrlList = new List<String>(); List<Site> siteList = [ ...
2
votes
0answers
18 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
0
votes
0answers
32 views

Custom Setting vs. Custom Object vs. Custom Metadata Type for Multiple Environment Credentials [duplicate]

I am looking to confirm the best practice of storing client / secret credentials for multiple environments for multiple external webservices within salesforce. Below is the analysis I have done ...
0
votes
0answers
52 views

Install for “All Users” vs “Admin Only” (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
5
votes
1answer
832 views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
0
votes
1answer
43 views

“https://sforgcompare.herokuapp.com/”Is this trusted tool for Salesforce org comparing sandbox to sandbox and sandbox to production [closed]

"https://sforgcompare.herokuapp.com/" is this trusted tool, any other tools for org comparing in Salesforce. Your comments/suggestions would be greatly appreciated. Thank you
0
votes
1answer
20 views

Open Page Redirect Issue

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. Id id = ...
0
votes
0answers
23 views

Embedded Chat PreChat Form

I am using the Salesforce embedded chat functionality in a customer community. For security purpose, I don't want users to be able to change their name and email address when using the chat ...
0
votes
1answer
517 views

Unable to Add quote line items : facing error insufficient priviledges

I am getting error "insufficient priviledeges while adding quote line item. Checked with permission setting for profile but still same. i have access to quote object. Got to the one point, when we ...
1
vote
1answer
46 views

Auditing changes made by an admin on behalf of another user

I am wondering whether we have an option/ functionality in Salesforce to store the details of the user who logs as a different user. Use Case I am a System Admin (User X) to a Salesforce instance ...
0
votes
1answer
47 views

How to pass Id in a encrypted format to public site in Salesforce?

I have created a public site where a VF page is exposed with a few URL parameter ( Id of a few objects ). Now I want to encrypt those Ids so that there is no security risk. I was trying to achieve it ...
0
votes
1answer
117 views

CheckMarx FLS Create/Update Vulnerability in Salesforce Apex Code [duplicate]

I need help in fixing below vulnerabilities found in CheckMarx scan. Scenario: I have written a trigger on FeedItem object. This trigger will archive the FeedItem into custom object ...
0
votes
1answer
41 views

Salesforce Data Mask and Workflows / Process Builder deactivation

I'm trying out Salesforce's Data Mask feature and in the docs (https://help.salesforce.com/articleView?id=data_mask_considerations.htm&type=5) it mentions that all workflows (and presumably ...
3
votes
0answers
73 views

Apex Row-Level Security is not applied to OwnerId field

It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement. public with sharing class ...
1
vote
1answer
31 views

Authentication Vulnerability Issue with Page Redirect

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. public Pagereference ...
0
votes
1answer
49 views

How to store OAuth credentials in Salesforce Securely [closed]

I have implemented a custom auth provider by following the steps from this help guide https://help.salesforce.com/articleView?id=sso_provider_plugin_custom.htm and the setup works as expected. Now ...
4
votes
1answer
1k views

Edit Permissions for Guest Users after “Secure guest user record access”

Salesforce Alerted me that at the end of February we would be forced into the security update for "Secure guest user record access". I tried this in my sandbox and it seems to have some adverse ...
0
votes
1answer
594 views

I have a problem with the data security supeadgr challenge

I set the profile several times but still continues with the error step 4 (Challenge Not yet complete... here's what's wrong: The Field Sales User profile does not have the correct permissions for ...
0
votes
0answers
11 views

How to create and manage session for sites for force.com in Salesforce

We have created a portal to login to the sites for the customer. We are managing the credential(username and password) on the third party website. When I open this link anywhere it shows that the ...
0
votes
1answer
434 views

Why can Portal user see custom object?

I have Org-Wide Defaults set to Private/Private with Grant Access Using Hierarchies unchecked on a custom object. I have a sharing rule that says users may read the object if it is marked Active = ...
0
votes
0answers
27 views

Security Health Check - not able to load baseline due to “recent changes”

When I open Security Health Check setup page I get following error: We're sorry. Due to recent changes, your custom baseline must be updated. Please export a new copy of the Salesforce Baseline ...
-1
votes
1answer
34 views

Apex FLS Methods

I have a question regarding Salesforce FLS. Is there any method available which dynamic check the object field-level security. Like I have Account object and Field name Phone and pass to any ...
0
votes
0answers
17 views

Bad Field Names on Insert Update in Integration (but not on all records in transaction)

Scenario We have an integration that upserts records against Sobject A, C and CO. (I'm using letters to represent for brevity) A - Account C - Contact CO - CustomSobject (junction Sobject between A &...
0
votes
1answer
18 views

How can I allow a profile to only have access to user creation and nothing else

I have cloned a read only profile and removed all access except manage users. I am still able to see custom code etc in set up and configuration. How can I restrict a user from accessing everything ...
0
votes
1answer
39 views

Apex triggers to interact with sql server [closed]

We are in the beginning stages of getting set up in Salesforce, and there is something that I am having a little trouble getting my head wrapped around; We currently have a local SQL server ...
0
votes
1answer
36 views

New Button on Account overriden with Lightning Component

I have overriden 'New' button on Account with an aura component. So when a user clicks on New button , all the Account record types get populated. The issue is, user has access to only 2 record types ...
0
votes
1answer
47 views

Check if users email has been verified?

When the users email address is changed an email is sent to the user asking them to verify the change of the email. The user then clicks on the link and confirms the email change. Is there anywhere ...
0
votes
0answers
19 views

Testing security of APIs

I have created Rest APIs and I have been using Postman to try them out using the system admin credentials. (Where you call the APIs using password grant_type and use the user password and security ...
0
votes
1answer
34 views

Require Login to View Lightning Component

Is there a way to require login before a user can see a Lightning Component in Salesforce Community?

1
2 3 4 5
15