Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
1
vote
0answers
16 views

How do I test the security of the Salesforce site? [duplicate]

What is the best practice to test security? In my case, I have a site with a database. Salesforce provides good data security of its users. So, in my Org, I have records (contacts, contact ...
5
votes
1answer
100 views

Omit debug logging for specific Apex class

Scenario I do not want information that is processed by an Apex class called SecureProcessor to make it into the debug log, regardless of the level of logging enabled within Salesforce Setup. ...
0
votes
0answers
22 views

record visibilty vs record level access

What are the difference between these? In the Sharing and Visibility Designer certificate exam guide it says: Articulate different security capabilities with respect to record visibility, CRUD ...
0
votes
1answer
510 views

Secure a Landing Page

I'm trying to have my landing Page HTTPS. In this link https://help.salesforce.com/articleView?id=mc_es_create_landing_page.htm&type=5 it's said that there's a check box where you can select the ...
0
votes
2answers
258 views

Sharing Rule is not granting access to a public group

I am working with an object called Scope Library. I want users to have read access by default. I want the group Presales to have read, edit and create access on the object. To give users read only ...
0
votes
1answer
47 views

Storing Credentials - Regharding appExchange product

We are developing AppExchange product where we need to communicate with different third party systems.For Instance , we are getting services from 5 different third party system,a user can have 5 ...
6
votes
2answers
1k views

Is my org's data accessible to Salesforce?

Salesforce protects our data. But does it protect the data from Salesforce itself ? Is my data always visible/accessible to Salesforce?
3
votes
1answer
37 views

Security setting issue in salesforce-OWD

I have a requirement on admin part. I have a profile called vetprofile where the users of the profile needs to see only specific records of an object which have assigned to field value is equal to ...
3
votes
1answer
389 views

How to invoke a flow/trigger if a user fails login attempt?

What Needs to Happen: When a user logs into the org, we perceive the attempt as either Successful (correct password), Failed (incorrect password), or Other. If the user fails the login attempt, a User ...
0
votes
2answers
195 views

How to override Opportunity Org-Wide Defaults Public Read Only

I would like to create a permission set or role which overrides the Opportunity Org-Wide Defaults of Public Read Only, such that users in with the permission set or in the role would only be able to ...
3
votes
0answers
278 views

Trying to call API through Apex with custom security certificate but getting CalloutException

I'm trying to use Apex to call some API endpoints to do some validation for my company. There are some specific properties of these APIs that make it a bit tricky: The APIs are hosted on self-...
4
votes
1answer
95 views

How to permanently get rid of sandbox new/refresh email-address pollution with “@example.com”

When you create/refresh a Sandbox, all (but the refreshing) users email addresses get crippled with a nice "example.com". Using security codes via email, this basically breaks the possibility for ...
3
votes
0answers
167 views

“Force relogin after Login-As-User” - But why?

In our health check, it is noted that we do not have "Force relogin after Login-As-User" enabled. Per the documentation, I can see what this checkbox does - but there is not much documentation on why ...
1
vote
0answers
100 views

Hide session parameter in the URl

is there a way to hide session id parameter in the URL of an org? Here, an example: https://my-special-org.cs66.force.com/WebApp/secur/frontdoor.jsp?sid=00Z3O000000TVmy%...
-1
votes
2answers
43 views

How to give custom object delete permission to all users in org?

The user can belong to any profile or role. In future, any new user created with a new profile or with a new role, he/she will get delete permission automatically. Please suggest a solution without ...
1
vote
1answer
278 views

Removing password/session settings from profiles to allow org defaults to apply to all users

Has anyone managed to remove profile session/password settings to allow the org defaults to apply to all users? Can't seem to remove session timeout to "none" on the profile UI, it only allows you to ...
0
votes
2answers
428 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
1
vote
1answer
131 views

Encrypting custom fields and returning unencrypted data on API calls

We have a need to encrypt a set of custom fields (data at rest) and we were thinking about using just the classic encryption. The data is served to mobile apps using API calls. Is it possible with ...
1
vote
1answer
46 views

Protecting encryption key in an unmanaged package

How do I protect an encryption key, a private AES-256 key (so that no one can access it including admins) within salesforce? I understand that this can be done using a managed package and installing ...
1
vote
1answer
117 views

How to secure the Salesforce lightning if a malicious user could change the parameter to execute

Let's say a site builder could use "community builder" to configure the Salesforce lightning component. On a login form, they can decide to use "email" or "username" to login in. However, the login ...
0
votes
1answer
75 views

OAuth2 User-Agent Flow: how to tell when access_token expires?

I'm using the User-Agent flow, and I successfully get back a, access_token. From here I have no way to determine when this token expires. I was hoping, that calling the https://test.salesforce.com/...
0
votes
1answer
40 views

CIDR block information is for Sales Force

I do not find related questions here, so can someone help to understand CIDR block information is for Salesforce related to pricing loader? Pricing loader is a custom build functionality in org, ...
2
votes
0answers
420 views

Collect Tracking Code Security

Question about Personalization Builder - Collect Tracking Security: When users go on a webpage with collect tracking code implemented, they send an invisible tracking pixel via the basic javascript ...
3
votes
4answers
3k views

Check if User has Permission to update Custom Metadata

I'm building Visualfroce for updating Custom Metadata. When User without required permissions tries to update them he gets I tried checking MetadataType__mdt.getSObjectType().getDescribe()....
0
votes
1answer
31 views

How to give read and edit, but not delete permissions to records users don`t own?

We give CRED permissions by Profile. On OWD we give Public Read/Write.
0
votes
1answer
68 views

Accounts Tab(Visualforce Tab) is not visible

Accounts Tab(Visualforce Tab) is not visible for a user even after adding in the Customise apps. It is not visible for users having a specific Profile. Checked with Read, create, edit, delete ...
3
votes
1answer
104 views

Is session duration guaranteed?

Let's assume that our session timeout value is set to the default 2 hours. The documentation defines this value as Length of time after which the system logs out inactive users. If the user is ...
0
votes
1answer
63 views

NPSP - Account: Restrict records view based on profile

We have a project, where we wants to use 1 profile (lets say "Tester") among others to only see Organization records, when he is browsing all Accounts records (as Tester). So far I made a change in ...
1
vote
0answers
267 views

Restricting Org Wide Email Addresses based on profile in Apex? [duplicate]

I have a class marked 'With Sharing' and a simple method to get all org wide emails to populate in a picklist on my page: public String getOrgEmails(){ List<OrgWideEmailAddress> ...
-1
votes
1answer
55 views

Why should one want the password to expire in Salesforce? [closed]

Why should one want the password to expire in Salesforce? Is it the same as a temporary account? Because if the password invalidates after some time that means the user won`t be able to login and ...
1
vote
2answers
1k views

What is the best way of storing username and password in salesforce?

I have one app, for this app we need to enter username and passwords and token. The app is working perfectly fine but when uploading in app exchange then security report is not passing it because we ...
0
votes
2answers
53 views

Will Sharing=ReadOnly allow my user to Delete or Clone a record

I have Lightning Quickactions for Delete and Clone on a CustomObject__c and I want to ensure that only users with the right permission can use it. From reading this documentation I understand that I ...
2
votes
1answer
79 views

DescribeFieldResult Class doesn't have encryption and masking methods

Unable to find any method for field encryption and field masking in DescribeFieldResult Class. Methods like getMaskType, getMask, isEncrypted are working with DescribeFieldResult. Is there any ...
0
votes
1answer
27 views

How to view name and profile of site guest user

I have sites in my Salesforce org. How do I view the name and profile of the giest user?
0
votes
1answer
1k views

Reset password for user without security question and answer

On the documentation it mentions the following: NOTE If the user hasn’t set a security question, or doesn’t answer the security question correctly, the password isn’t reset. What is the best way to ...
0
votes
1answer
112 views

Can we change FLS for required field?

I am aware of following: ProfileFieldLevelSecurity ProfileFieldLevelSecurity represents the field level security for users assigned to a profile. In API version 30.0 and later, permissions for ...
1
vote
1answer
83 views

Schema.describeSObjects() returns incorrect values

When I use Schema.describeSObjects() the result always returns isDeletable=TRUE, even though the current user doesn't have DELETE permission on an sObject; however if Schema.sObjectType.<<...
4
votes
1answer
640 views

Cookie with HttpOnly flag

I work on Demandware platform, and use dw.web.Cookie class. there is no way to add HttpOnly attribute to the new Cookie. Do we have any solution or workaround?
10
votes
3answers
6k views

What are permissions are needed to upload a file via a public Salesforce community page?

I would like to be able to upload files using <lightning:fileUpload which is on a public community page. The community is using template: Customer Account Portal. The files would get attached to ...
4
votes
3answers
2k views

How to Use lightning Locker Service in sandbox

I know how to configure security model through OWD, Sharing Rules, Profiles and Roles in salesforce sandbox account but how to use Lightning Security Locker Service instead of OWD, Sharing Rules...etc ...
2
votes
1answer
24 views

Restrict tab access via search

We have a group of users who are in a separate profile that we have hidden tabs from and setup basic security. However, we have found that some of them are "inquisitive" enough to use search to get ...
2
votes
1answer
90 views

Can you limit users visibility of salesforce content separately on mobile?

Like what if we just want our users to be able to access the calendar from the salesforce app. When they are in using their computer we want them to have full acess, but then when they are out and ...
1
vote
0answers
68 views

Visualforce change ws to wss in some orgs (localhost)

I have two sandboxes of different orgs. I am trying to open visualforce with same code: <apex:page > <script type="text/javascript"> var CONNECTION; window.onload = function ...
1
vote
1answer
517 views

Why the external and internal access for contacts should be same

As per Trailhead module (Link below), For contacts, you must set Controlled by Parent for both the default internal and external access. https://trailhead.salesforce.com/trails/communities/...
0
votes
1answer
42 views

Will Expired Managed Package prevent the access to standard object?

I'm facing the issue that none of my Org users can't create account since last 15 days. I've checked all privileges everything is fine even though the system administrator can't create account record. ...
2
votes
1answer
2k views

Lock sessions to the IP address from which they originated

After enabling "Lock sessions to the IP address from which they originated" still able to login to workbench in same session and callouts are also working. Didn't understand the working of it.How does ...
1
vote
1answer
123 views

can we encrypt %%emailaddr%% while passing to a page?

we pass %%emailaddr%% to a webpage as query string value. Can we encrypt the email on email send and webpage can decrypt it so email is never exposed? NOTE: In this case webpage is a 3rd party site ...
14
votes
1answer
4k views

Use a Named Credential with API key?

I want to be able to make callouts to JotForm, but they do not support OAuth and username/password is insufficient for their API. Here are their docs; for reference, here are the 3 auth options: ...
2
votes
1answer
485 views

LightningSelfRegisterController appears to be running in User context; shouldn't it run in System context?

I'm customizing the LightningSelfRegisterController shipped with Lightning Communities. I was surprised to learn that a query didn't return the results I was expecting, seamingly due to the context in ...
1
vote
2answers
958 views

Salesforce OWD and Profile settings?

I am confused with OWD and Profile. If an Object is set as Public Read-Only at OWD level and give write permission at Profile level, can the user edit the records? Is this the way to override OWD ...

1 2 3 4 5 14