Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

Salesforce mobile app - canvas app - pop up not working

I have a canvas app enable in a connected app. This canvas app is included in a visualforce page. The canvas app points to a web app hosted elsewhere. The web app authenticates its users by opening up ...
0
votes
0answers
16 views

Salesforce does not validate 'CSRF' token and responding properly

Our testing team has addressed that server does not validate the session cookie and CSRF token value. We have @remoteaction method action in the apex class to get the list of records. It is getting ...
0
votes
2answers
35 views

PMD Security error - Apex Suggest Using Named Cred

I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code. Blob headerValue = Blob.valueOf(username + ':' + password); String authorizationHeader = '...
0
votes
0answers
23 views

stripinaccessible stripping fields for system administrator

I have a generic function to validate CRUD before DML which uses stripInaccessible(). public static SObjectAccessDecision validateCRUD(AccessType access, List<SObject> records, Boolean ...
3
votes
2answers
66 views

Tightening security around Javascript Remoting from Visualforce

We have a community portal built off of Visualforce pages and on those pages we do a lot of Javascript Remoting. Due to the complexity of our org, most of the Apex classes holding these remote methods ...
2
votes
1answer
30 views

Using isSet() vs getRemovedFields() to identify inaccessible fields after stripInaccessible()

I am wondering is there a difference between isSet() and getRemovedFields() to identify inaccessible fields that were removed by the stripInaccessible() method. From the official documentation Enforce ...
0
votes
0answers
15 views

Help with records not displaying on Force.com site

I've been building a Salesforce Site but am having trouble getting records to display on the page. I am using a specific Visualforce page as the homepage and can get the records to display fine when I ...
0
votes
1answer
23 views

use post requests for cross-domain sessions - session setting

I have enabled this session setting in my sandbox org. I did not see any difference interms of impacts to my system.which areas it will affect our system What i need to test before moving it to the ...
0
votes
0answers
15 views

How to share parent records with a community user

When I create junction object with two parent objects I need to share parent record of this junction record with community user. How can I achieve this without Apex Share which enabled for Customer ...
1
vote
1answer
38 views

Summer 20 Release Guest Site - allow create custom object

We have a force.com site that has numerous VF pages to create a custom object. The Summer 20 release report says that we need to / will be forced to shut down access. I see that one can create sharing ...
2
votes
1answer
84 views

What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent?

This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present ...
2
votes
0answers
88 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
2
votes
2answers
136 views

Inherited Sharing not respected in trigger context

I know the differences between declaring a class inherited sharing, or leave it omitted, and between it and with sharing or without sharing, however I decided to test all the theory in the ...
1
vote
1answer
29 views

How quickly are updates to Custom Metadata Types committed?

In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/...
0
votes
1answer
29 views

Lock a Field on a Record based off of Profile

I have a field on a record that should only be editable by people with a certain profile. I can see that the read/edit is selected correctly under the field level security and I can see under the ...
0
votes
0answers
22 views

Set-up a File Location that is not on a standard port

According to documentation Marketing Cloud will only allow connections on the stardard 21/22 ports. The client has a security policy that doesn't allow access to standard ports. https://help....
2
votes
2answers
289 views

What is the impact of enabling the critical update 'Route My Domains Through Salesforce Edge'?

Based on the documentation, it'll use Machine Learning to improve connectivity and performance --> so is this going to switch Salesforce login by default to Edge?
2
votes
0answers
18 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
0
votes
0answers
34 views

Custom Setting vs. Custom Object vs. Custom Metadata Type for Multiple Environment Credentials [duplicate]

I am looking to confirm the best practice of storing client / secret credentials for multiple environments for multiple external webservices within salesforce. Below is the analysis I have done ...
0
votes
0answers
60 views

Install for “All Users” vs “Admin Only” (Salesforce CPQ)

I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for All Users, or ...
0
votes
2answers
26 views

How can I find the Secure URL for the public site by Apex?

We are using the following code to find the Secure URL for the public site by Apex List<String> siteFullUrlList = new List<String>(); List<Site> siteList = [ ...
0
votes
1answer
45 views

“https://sforgcompare.herokuapp.com/”Is this trusted tool for Salesforce org comparing sandbox to sandbox and sandbox to production [closed]

"https://sforgcompare.herokuapp.com/" is this trusted tool, any other tools for org comparing in Salesforce. Your comments/suggestions would be greatly appreciated. Thank you
0
votes
1answer
20 views

Open Page Redirect Issue

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. Id id = ...
0
votes
0answers
25 views

Embedded Chat PreChat Form

I am using the Salesforce embedded chat functionality in a customer community. For security purpose, I don't want users to be able to change their name and email address when using the chat ...
0
votes
0answers
83 views

Auth Provider with per-user Named Credential

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the ...
0
votes
1answer
47 views

How to pass Id in a encrypted format to public site in Salesforce?

I have created a public site where a VF page is exposed with a few URL parameter ( Id of a few objects ). Now I want to encrypt those Ids so that there is no security risk. I was trying to achieve it ...
1
vote
1answer
50 views

Auditing changes made by an admin on behalf of another user

I am wondering whether we have an option/ functionality in Salesforce to store the details of the user who logs as a different user. Use Case I am a System Admin (User X) to a Salesforce instance ...
0
votes
1answer
135 views

CheckMarx FLS Create/Update Vulnerability in Salesforce Apex Code [duplicate]

I need help in fixing below vulnerabilities found in CheckMarx scan. Scenario: I have written a trigger on FeedItem object. This trigger will archive the FeedItem into custom object ...
0
votes
1answer
41 views

Salesforce Data Mask and Workflows / Process Builder deactivation

I'm trying out Salesforce's Data Mask feature and in the docs (https://help.salesforce.com/articleView?id=data_mask_considerations.htm&type=5) it mentions that all workflows (and presumably ...
3
votes
0answers
73 views

Apex Row-Level Security is not applied to OwnerId field

It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement. public with sharing class ...
1
vote
1answer
33 views

Authentication Vulnerability Issue with Page Redirect

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. public Pagereference ...
0
votes
1answer
52 views

How to store OAuth credentials in Salesforce Securely [closed]

I have implemented a custom auth provider by following the steps from this help guide https://help.salesforce.com/articleView?id=sso_provider_plugin_custom.htm and the setup works as expected. Now ...
0
votes
0answers
11 views

How to create and manage session for sites for force.com in Salesforce

We have created a portal to login to the sites for the customer. We are managing the credential(username and password) on the third party website. When I open this link anywhere it shows that the ...
4
votes
1answer
405 views

How to troubleshoot Exception thrown when using WITH SECURITY_ENFORCED

I've added the WITH SECURITY_ENFORCED clause to my SOQL queries. I'm testing them with a user who has a permission set that grants all object permissions (read, create, etc.), and also has read and ...
-1
votes
1answer
36 views

Apex FLS Methods

I have a question regarding Salesforce FLS. Is there any method available which dynamic check the object field-level security. Like I have Account object and Field name Phone and pass to any ...
0
votes
0answers
18 views

Bad Field Names on Insert Update in Integration (but not on all records in transaction)

Scenario We have an integration that upserts records against Sobject A, C and CO. (I'm using letters to represent for brevity) A - Account C - Contact CO - CustomSobject (junction Sobject between A &...
0
votes
1answer
18 views

How can I allow a profile to only have access to user creation and nothing else

I have cloned a read only profile and removed all access except manage users. I am still able to see custom code etc in set up and configuration. How can I restrict a user from accessing everything ...
0
votes
1answer
40 views

Apex triggers to interact with sql server [closed]

We are in the beginning stages of getting set up in Salesforce, and there is something that I am having a little trouble getting my head wrapped around; We currently have a local SQL server ...
0
votes
1answer
36 views

New Button on Account overriden with Lightning Component

I have overriden 'New' button on Account with an aura component. So when a user clicks on New button , all the Account record types get populated. The issue is, user has access to only 2 record types ...
0
votes
1answer
47 views

Check if users email has been verified?

When the users email address is changed an email is sent to the user asking them to verify the change of the email. The user then clicks on the link and confirms the email change. Is there anywhere ...
0
votes
0answers
19 views

Testing security of APIs

I have created Rest APIs and I have been using Postman to try them out using the system admin credentials. (Where you call the APIs using password grant_type and use the user password and security ...
0
votes
0answers
27 views

Security Health Check - not able to load baseline due to “recent changes”

When I open Security Health Check setup page I get following error: We're sorry. Due to recent changes, your custom baseline must be updated. Please export a new copy of the Salesforce Baseline ...
0
votes
1answer
13 views

Disable Ability to Edit RecordType

I have a custom object with a Record Type that is read-only on the page layout but I can still make updates to the Record Type on the page. Why is this? I want to make the field un-editable, is there ...
0
votes
1answer
35 views

Require Login to View Lightning Component

Is there a way to require login before a user can see a Lightning Component in Salesforce Community?
1
vote
0answers
28 views

Import CA-Signed Certificate from One Org into Another via MetadataAPI

I am trying to automate the set up of some of my lower sandboxes. In my SandboxPostCopy class, I'm using the FinancialForce MetadataAPI wrapper MetadataService to query and upsert a certificate. (...
0
votes
0answers
9 views

Salesforce Consumer Goods Cloud

I'm implementing Salesforce Consumer Goods Cloud and on the Retail Store standard object OwnerId NOT showing under "Fields & Relationships", so I'm unable to add it to the Retail Store page layout/...
1
vote
2answers
643 views

“You do not have access to the Apex class named …”: cannot find the cause

I have developed a Lightning Web Component in a sandbox, consisting of HTML, JS, some actions and a few Apex classes. I have tested this as sysadmin and as another non-sysadmin user. No problems. ...
0
votes
1answer
24 views

Debugging best practices - callouts and security risks [closed]

What is the best practice for debugging callouts and their endpoints that are stored in custom metadata or custom settings? What are the possible threats and security risks if adding this sensitive ...
1
vote
1answer
18 views

XML format for IP Ranges in Security Settings

I'm trying to use sfdx for source based development. Trying to define the range of whitelisted IPs in Security.settings-meta.xml. When I push my code to my org I get an error: Error force-app/main/...
0
votes
1answer
30 views

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?

How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects? Can I check the above using AuthSession object's ...

1
2 3 4 5
15