Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

189 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
107 views

Securely logging out as any user

When using the functionality where the system admin can log in as any user, I noticed that during log-out, there are two different responses that I can get back from /secur/logout.jsp. The most common ...
6
votes
1answer
854 views

Outbound Message Security and Validation

I am investigating the security implications of using Salesforce's Outbound Messages. I have reviewed the documentation about security for Outbound Messages. Does Salesforce have a way of ...
5
votes
1answer
835 views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
5
votes
1answer
275 views

Insufficient Privileges for Public Group Memberships Page

A user is a part of multiple public groups in Salesforce and has a custom profile. When the user navigates to the personal information page and clicks on the 'Go To List' link available under the '...
4
votes
1answer
1k views

Edit Permissions for Guest Users after “Secure guest user record access”

Salesforce Alerted me that at the end of February we would be forced into the security update for "Secure guest user record access". I tried this in my sandbox and it seems to have some adverse ...
4
votes
1answer
51 views

How to check from Apex code if custom setting is protected?

The question is simple: Is there any way to figure out from Apex code if custom settings is marked as protected or not? Looking through DescribeSObjectResult cannot find any single method related to ...
4
votes
0answers
73 views

Enable Apex Classes - Sometimes Only Global, Sometimes Includes Public

I have a managed package that I distribute to clients and I'm running into a curious situation trying to help one install. I have noticed that in the Enable Apex Classes for their System Administrator ...
4
votes
0answers
65 views

Visualforce Remote Objects Returning Empty Objects

I've got a remote object query operation that's failing in our managed package in a particular client's org. Essentially it queries an object with some filters based on the date, and it's returning ...
4
votes
0answers
29 views

How to help portal/community users with out TLS 1.1 enabled?

Salesforce will be phasing out support for TLS 1.0 over the coming year. Browsers will need TLS 1.1 or higher to connect to Salesforce. Users of Internet Explorer v, 8, 9, & 10 on Windows 7 or v. ...
4
votes
0answers
648 views

How to control custom object through territory management?

I have 2 custom objects and tabs. Accounts and Users are assigned manually in my org. How to I control their visibility/security according to territories? Are there any samples that I refer to? That ...
4
votes
0answers
2k views

How to resolve system.security.NoAccessException error

I am getting this exception. system.security.NoAccessException: Update access denied for Custom_Object__c Whats the reason for this? why i am getting this error. I have given all profile level, ...
3
votes
0answers
73 views

Apex Row-Level Security is not applied to OwnerId field

It seems that the Apex row-level security enforcement by with sharing keyword is not applied to the field OwnerId, when it is directly passed to update statement. public with sharing class ...
3
votes
1answer
56 views

Transaction Security is not available in Scratch Org

How am I able to turn on the visibility for transaction security? I am trying to test an apex class that implements TxnSecurity.PolicyCondition and according to this article to be able to see these ...
3
votes
0answers
68 views

Standard User with “Modify Metadata” fails to create active Picklist Value

What is failing here perfectly works for a SysAdmin user. I have a StandardUser with a permission set which grants him ModifyMetadata and calling this code creates the Picklist Value but leaves it ...
3
votes
0answers
70 views

Password policies remain after deleting profile?

I deleted a profile via the Metadata API, and it did not delete its associated password policies. I cannot find the policies anywhere in the UI, but when I pull from production (or any sandbox ...
3
votes
0answers
321 views

Trying to call API through Apex with custom security certificate but getting CalloutException

I'm trying to use Apex to call some API endpoints to do some validation for my company. There are some specific properties of these APIs that make it a bit tricky: The APIs are hosted on self-...
3
votes
0answers
226 views

“Force relogin after Login-As-User” - But why?

In our health check, it is noted that we do not have "Force relogin after Login-As-User" enabled. Per the documentation, I can see what this checkbox does - but there is not much documentation on why ...
3
votes
1answer
701 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
3
votes
0answers
162 views

System Authenticated Redirection - redirecting to login page over and over

I'm trying to set up a 'System Authenticated Redirection' microsite in Marketing Cloud. Even though I'm logged in, it keeps redirecting me to the login page. I enter my details over and over again, ...
3
votes
0answers
1k views

To enable Require secure connections (HTTPS) for all third-party domains

I have to increase the security level of my org. I know that if I activate "Require Secure Connections (https) for all third-party domains" I may have problems with pre-existing integrations. How can ...
3
votes
1answer
133 views

Why I need “Connect Salesforce Authenticator” during activation of “myDomain”?

I'm working on a Sandbox and I need to use Custom Lightning Components. Therefore I need to activate the myDomain feature. I've done that several times before, but today I get stuck in the process. ...
3
votes
1answer
287 views

Marketing Cloud SQL Injection?

I had a question come up that seemed a bit ridiculous at first, but has got me wondering. Is it possible to run any sort of script or SQL injection equivalency on forms that are configured to direct ...
3
votes
0answers
240 views

Can public force.com sites be accessed from “restricted countries”

As from the summer 15 release, Salesforce started blocking users from logging in from "restricted countries" like Cuba and Iran. (http://trust.salesforce.com/trust/blocked) Does this also apply to ...
3
votes
0answers
87 views

Permission Set issue

I am writing to you in order to describe permission set issue that i don't know how to figure out. I want to give an access to part of financial force package (possibility to assign current company ...
3
votes
1answer
257 views

Does OAuth token (from mobile SDK) still work in local browser?

I'm working on the Mobile app development. Here is my issue: We have got a token through the OAuth flow in App using SDK. There is a link in app named "user info", user tap that link and open a local ...
2
votes
0answers
88 views

How can I detect in Apex code that a user has or doesn't have access to the custom setting?

I have created a new Custom Setting Test__c and enabled feature Restrict access to custom settings in Schema Settings. Now I expect that a code in user context (Anonymous Execution Window) would ...
2
votes
0answers
18 views

Is there a way to make field level data classification required before creating a new custom field?

End user has stringent policies on data classification and controls. Need to have policies and procedures in place to ensure all fields are reviewed, classified and if highly sensitive, encrypted. ...
2
votes
0answers
46 views

Guest User Create and Update permission after Spring '20

During Spring '20 Salesforce is deploying a set of security updates regarding the Guest User profile and its capabilities, mainly limiting it from being able to create and update records. We have ...
2
votes
0answers
28 views

How to enable CORS in a community

Hi i've recently encountered a problem where i needed CORS to be enabled for some domains. In the Salesforce Org i can specify CORS to be enabled for some domains. The problem lies with community ...
2
votes
0answers
35 views

Schema.sObjectType.Task.fields.Subject.isUpdateable() is false in force.com site

We have managed a package where we are using apexrest through force.com site to update the task records. This works fine unless we add security enforce through apex getDescribe() like, Schema....
2
votes
1answer
276 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
2
votes
1answer
401 views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
2
votes
0answers
499 views

Collect Tracking Code Security

Question about Personalization Builder - Collect Tracking Security: When users go on a webpage with collect tracking code implemented, they send an invisible tracking pixel via the basic javascript ...
2
votes
0answers
72 views

Crypto sign string using DSA private key in Salesforce

Colleagues, I'm doing integration using REST API with a service that requires a string signed by private key which uses DSA algorithm. The problem is in APEX Crypto class does not support DSA keys (...
2
votes
0answers
193 views

Getting insufficient Privileges error on custom field only when in inputField or outputField

I have a custom field on the Service Contract that I am referencing on a Visualforce Page, which is getting this Insufficient Privileges error: Insufficient Privileges You do not have the level of ...
2
votes
0answers
41 views

Enabling Platform Encryption on two packages

We have two managed packages and one is the base package for the other and contains all the fields (no fields on the second package). We want to enable platform encryption on the fields of the base ...
2
votes
0answers
143 views

Security Implications with Production ID and Organization ID

Is there any issue with having your organization ID and your production ID seen in links? I am having to upload image files as Documents into my salesforce org and then send the image through ...
2
votes
0answers
42 views

Users can edit anything when I use a VF page as an Edit override

I want to allow my users to only edit records they own with two objects which are in a Master/Detail setup. I have the following setup : Master Object : OWD : Public Read Only User's Permission Set ...
2
votes
0answers
144 views

OpportunityContactRole security

In a nutshell, how from the REST API (outside the Apex wall here), can I tell I can create/edit/remove an OpportunityContactRole from scratch. Part I of the answer is I believe the ...
2
votes
1answer
610 views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
2
votes
0answers
36 views

Require login on each access of Salesforce1 app

I would like to require our users to have to enter their Salesforce password each time (or after a certain time of inactivity) they access the Salesforce1 app on their IOS and Android devices. The ...
2
votes
0answers
120 views

Role for Inactive users

In our salesforce instance the roles were cleaned up and as a result some of the inactive user's role were deleted, now those inactive users owned records are not pulled in reports as the owner of ...
2
votes
0answers
2k views

Why might a certificate import fail, when uploading a certificate not created from a Salesforce-generated Certificate Signing Request?

I've been given two X509 certificates to upload into an org for use in SSO (one for signing, one for decrypting), but I can't seem to upload either of them successfully. As I've been given the ...
2
votes
1answer
184 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link https://developer.salesforce.com/page/...
2
votes
0answers
149 views

Accessing Salesforce session via oAuth maintains session across browsers

I am using oAuth 2.0 Web server flow to connect to Salesforce org and get the Access token and refresh token. I use the following URL to access a visualforce page that resides within the Salesforce ...
2
votes
0answers
320 views

Role based sharing: All Components in Salesforce and what is the best way to make existing changes

Not sure what is the best way to ask this question I am listing down all the places (configuration only) components where force.com platform provides option to share/assign based on Role, Role and ...
2
votes
1answer
589 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
2
votes
0answers
166 views

Should we give the guest user profile the “view encrypted data” permission?

We've developed native VF/Apex code that allows us to send a link to a customer and have them securely view a PDF of their contract (contract is a VF page generated using data from fields in their ...
2
votes
0answers
688 views

Change default app for customer portal profiles

I cannot uninstall an AppExchange application because it is the default app for the Customer Portal profiles. However, when I try to edit these profiles, they are read-only with respect to the ...
1
vote
1answer
33 views

Authentication Vulnerability Issue with Page Redirect

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability. public Pagereference ...