Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

172 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
106 views

Securely logging out as any user

When using the functionality where the system admin can log in as any user, I noticed that during log-out, there are two different responses that I can get back from /secur/logout.jsp. The most common ...
6
votes
1answer
838 views

Outbound Message Security and Validation

I am investigating the security implications of using Salesforce's Outbound Messages. I have reviewed the documentation about security for Outbound Messages. Does Salesforce have a way of ...
5
votes
0answers
58 views

Add Community members via Apex?

Is it possible to add/change/delete Community members using Apex? I know how to do this via the UI (see picture below), but I'm looking to automate some things on the demo side of the business for ...
5
votes
1answer
784 views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
5
votes
1answer
250 views

Insufficient Privileges for Public Group Memberships Page

A user is a part of multiple public groups in Salesforce and has a custom profile. When the user navigates to the personal information page and clicks on the 'Go To List' link available under the '...
4
votes
0answers
73 views

Enable Apex Classes - Sometimes Only Global, Sometimes Includes Public

I have a managed package that I distribute to clients and I'm running into a curious situation trying to help one install. I have noticed that in the Enable Apex Classes for their System Administrator ...
4
votes
0answers
64 views

Visualforce Remote Objects Returning Empty Objects

I've got a remote object query operation that's failing in our managed package in a particular client's org. Essentially it queries an object with some filters based on the date, and it's returning ...
4
votes
0answers
29 views

How to help portal/community users with out TLS 1.1 enabled?

Salesforce will be phasing out support for TLS 1.0 over the coming year. Browsers will need TLS 1.1 or higher to connect to Salesforce. Users of Internet Explorer v, 8, 9, & 10 on Windows 7 or v. ...
4
votes
0answers
631 views

How to control custom object through territory management?

I have 2 custom objects and tabs. Accounts and Users are assigned manually in my org. How to I control their visibility/security according to territories? Are there any samples that I refer to? That ...
4
votes
0answers
2k views

How to resolve system.security.NoAccessException error

I am getting this exception. system.security.NoAccessException: Update access denied for Custom_Object__c Whats the reason for this? why i am getting this error. I have given all profile level, ...
3
votes
1answer
49 views

Transaction Security is not available in Scratch Org

How am I able to turn on the visibility for transaction security? I am trying to test an apex class that implements TxnSecurity.PolicyCondition and according to this article to be able to see these ...
3
votes
0answers
63 views

Standard User with “Modify Metadata” fails to create active Picklist Value

What is failing here perfectly works for a SysAdmin user. I have a StandardUser with a permission set which grants him ModifyMetadata and calling this code creates the Picklist Value but leaves it ...
3
votes
0answers
60 views

Password policies remain after deleting profile?

I deleted a profile via the Metadata API, and it did not delete its associated password policies. I cannot find the policies anywhere in the UI, but when I pull from production (or any sandbox ...
3
votes
0answers
296 views

Trying to call API through Apex with custom security certificate but getting CalloutException

I'm trying to use Apex to call some API endpoints to do some validation for my company. There are some specific properties of these APIs that make it a bit tricky: The APIs are hosted on self-...
3
votes
0answers
186 views

“Force relogin after Login-As-User” - But why?

In our health check, it is noted that we do not have "Force relogin after Login-As-User" enabled. Per the documentation, I can see what this checkbox does - but there is not much documentation on why ...
3
votes
1answer
603 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
3
votes
0answers
152 views

System Authenticated Redirection - redirecting to login page over and over

I'm trying to set up a 'System Authenticated Redirection' microsite in Marketing Cloud. Even though I'm logged in, it keeps redirecting me to the login page. I enter my details over and over again, ...
3
votes
0answers
971 views

To enable Require secure connections (HTTPS) for all third-party domains

I have to increase the security level of my org. I know that if I activate "Require Secure Connections (https) for all third-party domains" I may have problems with pre-existing integrations. How can ...
3
votes
1answer
41 views

How to check from Apex code if custom setting is protected?

The question is simple: Is there any way to figure out from Apex code if custom settings is marked as protected or not? Looking through DescribeSObjectResult cannot find any single method related to ...
3
votes
1answer
126 views

Why I need “Connect Salesforce Authenticator” during activation of “myDomain”?

I'm working on a Sandbox and I need to use Custom Lightning Components. Therefore I need to activate the myDomain feature. I've done that several times before, but today I get stuck in the process. ...
3
votes
1answer
253 views

Marketing Cloud SQL Injection?

I had a question come up that seemed a bit ridiculous at first, but has got me wondering. Is it possible to run any sort of script or SQL injection equivalency on forms that are configured to direct ...
3
votes
0answers
231 views

Can public force.com sites be accessed from “restricted countries”

As from the summer 15 release, Salesforce started blocking users from logging in from "restricted countries" like Cuba and Iran. (http://trust.salesforce.com/trust/blocked) Does this also apply to ...
3
votes
0answers
85 views

Permission Set issue

I am writing to you in order to describe permission set issue that i don't know how to figure out. I want to give an access to part of financial force package (possibility to assign current company ...
3
votes
1answer
254 views

Does OAuth token (from mobile SDK) still work in local browser?

I'm working on the Mobile app development. Here is my issue: We have got a token through the OAuth flow in App using SDK. There is a link in app named "user info", user tap that link and open a local ...
2
votes
0answers
31 views

Guest User Create and Update permission after Spring '20

During Spring '20 Salesforce is deploying a set of security updates regarding the Guest User profile and its capabilities, mainly limiting it from being able to create and update records. We have ...
2
votes
0answers
21 views

How to enable CORS in a community

Hi i've recently encountered a problem where i needed CORS to be enabled for some domains. In the Salesforce Org i can specify CORS to be enabled for some domains. The problem lies with community ...
2
votes
0answers
28 views

Schema.sObjectType.Task.fields.Subject.isUpdateable() is false in force.com site

We have managed a package where we are using apexrest through force.com site to update the task records. This works fine unless we add security enforce through apex getDescribe() like, Schema....
2
votes
1answer
131 views

What are the security implications of using a self signed certificate for the JWT-Based Auth flow or to authorize a connected app in Salesforce?

I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based ...
2
votes
1answer
785 views

Edit Permissions for Guest Users after “Secure guest user record access”

Salesforce Alerted me that at the end of February we would be forced into the security update for "Secure guest user record access". I tried this in my sandbox and it seems to have some adverse ...
2
votes
0answers
435 views

Collect Tracking Code Security

Question about Personalization Builder - Collect Tracking Security: When users go on a webpage with collect tracking code implemented, they send an invisible tracking pixel via the basic javascript ...
2
votes
0answers
64 views

Crypto sign string using DSA private key in Salesforce

Colleagues, I'm doing integration using REST API with a service that requires a string signed by private key which uses DSA algorithm. The problem is in APEX Crypto class does not support DSA keys (...
2
votes
0answers
176 views

Getting insufficient Privileges error on custom field only when in inputField or outputField

I have a custom field on the Service Contract that I am referencing on a Visualforce Page, which is getting this Insufficient Privileges error: Insufficient Privileges You do not have the level of ...
2
votes
0answers
41 views

Enabling Platform Encryption on two packages

We have two managed packages and one is the base package for the other and contains all the fields (no fields on the second package). We want to enable platform encryption on the fields of the base ...
2
votes
0answers
119 views

Security Implications with Production ID and Organization ID

Is there any issue with having your organization ID and your production ID seen in links? I am having to upload image files as Documents into my salesforce org and then send the image through ...
2
votes
0answers
42 views

Users can edit anything when I use a VF page as an Edit override

I want to allow my users to only edit records they own with two objects which are in a Master/Detail setup. I have the following setup : Master Object : OWD : Public Read Only User's Permission Set ...
2
votes
0answers
136 views

OpportunityContactRole security

In a nutshell, how from the REST API (outside the Apex wall here), can I tell I can create/edit/remove an OpportunityContactRole from scratch. Part I of the answer is I believe the ...
2
votes
1answer
543 views

Permission Sets on Quotes Template

I would like to create a permission set to give an access to all quote templates. I do not want some users within the same profile to see or have access to the quotes template. How to user can only ...
2
votes
0answers
36 views

Require login on each access of Salesforce1 app

I would like to require our users to have to enter their Salesforce password each time (or after a certain time of inactivity) they access the Salesforce1 app on their IOS and Android devices. The ...
2
votes
0answers
115 views

Role for Inactive users

In our salesforce instance the roles were cleaned up and as a result some of the inactive user's role were deleted, now those inactive users owned records are not pulled in reports as the owner of ...
2
votes
0answers
2k views

Why might a certificate import fail, when uploading a certificate not created from a Salesforce-generated Certificate Signing Request?

I've been given two X509 certificates to upload into an org for use in SSO (one for signing, one for decrypting), but I can't seem to upload either of them successfully. As I've been given the ...
2
votes
2answers
1k views

Restricting record level access in role hierarchy

If i set the OWD for Account as private and if i create a public group and add some users into that and create a sharing rule for giving read and write access to that public group then managers of the ...
2
votes
1answer
182 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link https://developer.salesforce.com/page/...
2
votes
0answers
148 views

Accessing Salesforce session via oAuth maintains session across browsers

I am using oAuth 2.0 Web server flow to connect to Salesforce org and get the Access token and refresh token. I use the following URL to access a visualforce page that resides within the Salesforce ...
2
votes
0answers
316 views

Role based sharing: All Components in Salesforce and what is the best way to make existing changes

Not sure what is the best way to ask this question I am listing down all the places (configuration only) components where force.com platform provides option to share/assign based on Role, Role and ...
2
votes
1answer
572 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
2
votes
0answers
157 views

Should we give the guest user profile the “view encrypted data” permission?

We've developed native VF/Apex code that allows us to send a link to a customer and have them securely view a PDF of their contract (contract is a VF page generated using data from fields in their ...
2
votes
0answers
683 views

Change default app for customer portal profiles

I cannot uninstall an AppExchange application because it is the default app for the Customer Portal profiles. However, when I try to edit these profiles, they are read-only with respect to the ...
1
vote
0answers
63 views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY after Guest User Security Update

This month salesforce is rolling out a new security updated that prevents public sharing of record data, except via Sharing Rules that only provide Read-Only access. In preparing for this shift, I ...
1
vote
0answers
28 views

Need more than 50 Sharing Rules - now what?

The Requirement: Our organisation works in ~30 countries and has 6 groupings of workers ("Core Competencies") within each country. We have a number of Objects with OWD = Private and we need to ...
1
vote
0answers
84 views

Scan uploaded files for viruses

I have a public Salesforce Community that I use like Web To Case - for clients to create new cases in my org. For implementing that, I have developed a lightning web component that creates a case. ...