Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
79
votes
7answers
13k views

Apex static code analysis

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue ...
61
votes
8answers
51k views

What is the best way to deploy profiles in Salesforce? (especially system admin)

What is the best way to deploy profiles in Salesforce? I have a system admin profile with access given to the objects that i have created in my sandbox. I have about 1000 fields across these objects. ...
10
votes
3answers
8k views

What are permissions are needed to upload a file via a public Salesforce community page?

I would like to be able to upload files using <lightning:fileUpload which is on a public community page. The community is using template: Customer Account Portal. The files would get attached to ...
6
votes
1answer
3k views

Securely Storing a static API secret/key in a Salesforce app

I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an ...
24
votes
5answers
13k views

Can web-to-lead be protected from spammers without additional server side processing?

The default web-to-lead functionality that Salesforce provides makes it really easy to drop an HTML form onto any web page and submit leads straight into a Salesforce Org. E.g. <form action="...
9
votes
1answer
9k views

Basic Http Authentication

I am writing a web service for which sends a SOAP payload as its body. In order to access the 3rd party server, I need an authenticated user. I am using Basic Http authentication for that purpose. ...
4
votes
1answer
3k views

Securing Sensitive Information with Salesforce Best Practices

I am working on an org in unlimited edition. Most of the 20 schools we are creating online applications for have separate banks. I am new to Salesforce and wondering what the best practice is for ...
33
votes
2answers
17k views

How to access profile permissions via API

If I know the name of a certain profile, I would like to obtain CRUD permission settings for each object in the profile using Apex. I see that there is an sObject called Profile, but this only ...
26
votes
2answers
17k views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
45
votes
4answers
28k views

Can I get my security token without having to reset it?

I need to get a user's security token but there are other things currently using it so I don't really want to reset it. Is there any way to retrieve this without having to reset it?
10
votes
2answers
4k views

How to set public inline images in Knowledge Base Article

Background I'm developing an standard FAQ using Knowledge Base Articles. I've defined an Article Type FAQ which contains a Rich Text field called "Answer". The FAQ articles are exposed to an ...
9
votes
1answer
11k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
2
votes
1answer
1k views

Root cause for “Entity is not org-accessible” for sharing object?

Not able to find Sharing object for custom object Apttus_Proposal__Proposal__Share; giving me error while List<Apttus__APTS_Agreement__share> st = new List<Apttus__APTS_Agreement__c>();
15
votes
2answers
5k views

are Triggers (and their delegated classes) or Batch affected by sharing?

I understand with sharing classes run in User Mode, meaning they respect permissions, field-level security and sharing rules of the current user. I understand without sharing classes run in System ...
9
votes
1answer
19k views

How to use the escapeSingleQuotes method?

I'm trying to use this method in a dynamic SOQL query. Follow the sample code: public static String getRowById(String sobjName, id id) { String query = 'SELECT '; Map<String, ...
10
votes
2answers
2k views

Javascript Remoting CSRF

A third party security review is suggesting I need to add CSRF prevention to my javascript remoting calls. I'm not sure what is the best way to proceed. Switching to an apex:form to utilize built in ...
8
votes
4answers
16k views

What overrides a profile?

I am confused about the hierarchy of settings 1) I have a profile A and it has a read only access. I have a permission set specific to an user and the permission set grants the user access to edit ...
10
votes
2answers
2k views

Newbie Q: Is “Field Level Security” the same as “Field Accessibility”?

There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
3
votes
2answers
2k views

Cryptoclass Throws Error. Invalid private key. Must be 16 bytes. Sending 16 characters long key

key__c :- abcdefghijklmnop public static String decrypt(String data) { EncryptionSettings__c settings = EncryptionSettings__c.getOrgDefaults(); if (settings.key__c == null) { throw ...
2
votes
3answers
6k views

Can we deploy PROFILES alone from one sandbox to another?

Can we deploy only profiles from one sandbox to another? Thanks
5
votes
1answer
882 views

Edit Insufficient Privileges Page

Is there any way to gain access to the standard "Insufficient Privileges" page that everyone knows and loves(hates), in order to edit/replace it with something else? I imagine something along the ...
4
votes
1answer
346 views

Does Salesforce support PKCE validation in Web server flow?

In Salesforce OAuth2.0 Web Server flow, there is an option to not require a client key. But I am not sure whether it supports OAuth 2.0 RFC 7636: https://oauth.net/2/pkce/, which is the PKCE ...
3
votes
1answer
3k views

invalid security token

Hi we were given an ExactTarget php application to port from an older Magento installation to a new Magento installation. This code is based on the ExactTargetSoapClient, soap-wsse.php and xmlseclibs....
2
votes
1answer
154 views

Want to prevent a user to access other user cases

I Want to prevernt user to access other user cases in search and report as well in salesforce, when user at same level in role hierarchy. My Organization-Wide Defaults setting is following Case: ...
1
vote
2answers
2k views

Hide a Field From ONE User

Scenario: If I had a Custom Profile / Standard Profile, say Sales,and I have 50 Users assigned to the same Profile and had same Permission / Access on a particular object (Could be Standard or Custom ...
0
votes
0answers
82 views

Auth Provider with per-user Named Credential

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
26
votes
10answers
12k views

Can I compare Profiles?

We have many profiles in our org, and I suspect that some of them are redundant because the person who originally set them up didn't seem to understand the purpose of Profiles (confusion with Roles, ...
15
votes
4answers
9k views

Giving users access to a specific custom setting without granting them Customize Application access

I'm working on a VF page to give some users access to certain custom settings without given them the entire Customize Application access. Is there anyway to edit and commit data into the system as an ...
12
votes
2answers
7k views

Deploying Profiles / Permission Sets that include object & field permissions for Managed Objects

Anyone know if it's possible to deploy profiles/permission sets via Eclipse or an Unmanaged Package that contain object & field permissions for 3rd party managed objects? I'm trying to deploy a ...
8
votes
1answer
2k views

Critical Update “Serve Static Resources from the Visualforce Domain” still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
10
votes
2answers
2k views

Deploying From Sandbox (Enterprise) - loss of permissions, field security, etc

I have been reading up on this particular area of concern and from what I'm reading, it sounds like the solution I've been creating for the past two weeks is going to be a nuisance to deploy from ...
9
votes
2answers
2k views

Is encrypting passwords in protected custom settings a security requirement?

Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain ...
5
votes
1answer
210 views

Determine org. wide security on an object

I'm trying to determine (in APEX) what the security level is of a custom sObject (for a UI) For example: mysObject__c (Public Read Only, Private, etc.) I know it's possible to test the by inserting ...
3
votes
2answers
281 views

Does with sharing enforce OLS/FLS?

I am really confused about this one. I have done my share of research. In the documentation, it has been mentioned that with sharing keyword is used to enforce sharing rules for the current user. It ...
1
vote
1answer
449 views

Related to Digital signiature

Something related to Digital signature if we have a doc in sales-force and needs to be digitally signed, which involves digital certificates.. and how we can use crypto class of apex in this. also ...
1
vote
1answer
2k views

Refused to display 'https://www.salesforce.com/de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

I created VF page (or also to see the VF page inside a lightning component). I added an apex iframe with src="https://www.salesforce.com/de/" (or any other source) from salesforce apex iframe guide....
20
votes
5answers
3k views

Is it possible to have different password policies for different users?

Can I have a certain profile to have a password change policy of 1 year, and other profiles (or the rest) as change every 60 days? I know you can set it for the entire organization, I need to specify ...
15
votes
4answers
2k views

Twilio Integration and SSLv3 POODLE Vulnerability

I have an existing integration with Twilio that works great - Twilio posts a message to a custom SFDC REST endpoint, and we can generate a new SMS message by calling out to the standard Twilio REST ...
14
votes
3answers
5k views

How do I find out if a user has access to a visualforce page through apex?

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown. Sometimes the logged in user will ...
8
votes
2answers
264 views

PIN Security for a Force.com Mobile SDK App

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown ...
8
votes
1answer
793 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
5
votes
4answers
10k views

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
4
votes
1answer
3k views

system.security.NoAccessException: Update access denied for RecordType

I have a Visualforce Page that uses a standard controller (Opportunity) and an extension. In the extension I have a method that saves updates to the opportunity and a related contact. The extension is ...
4
votes
2answers
9k views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: insufficient access rights on cross-reference id: []

I have a custom object Resource__c having master detail with Account object. I have Account1 created by User1 and if User2 goes to create resource on Account1 then below error is given :"...
4
votes
2answers
7k views

X-Frame option set to deny in I-Frame inside salesforce

I am struggling with a error when i am trying to display a page of external application in an i-frame using tag due to an error X-frame Options Set to Deny .I have attached the screenshot of issue i ...
3
votes
1answer
1k views

list of permissions included in a permission set?

I want to see which permissions are included in one of my permission sets. is there a way to get them all at once? Best I can see is that you have to go through 5- 6 different screens
3
votes
1answer
2k views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
3
votes
1answer
161 views

What is the value of using an OAuth flow for your own external systems

I'd like to begin by saying that I'm not talking about systems outside of a given company. I understand how OAuth is important for an application like workbench, where you don't know who the people ...
1
vote
1answer
436 views

Security scanner: enforcing CRUD. Auto scanner reported issue

I have a question here regarding to Security scan: enforcing CRUD. For the example case deletion, but we also have problems with update and creation. Before I delete a record, I apply deletable check ...
1
vote
0answers
306 views

Where I can store access and secret keys for callouts to AWS SQS service? Should I use Named Credentials or other means suit better for this case

This question has an answer to how to send request to Amazon SQS service from Apex. However, I am concerned that we have to expose access and secret keys in the code. Is this possible to use Named ...