Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
2
votes
1answer
25 views

Restrict tab access via search

We have a group of users who are in a separate profile that we have hidden tabs from and setup basic security. However, we have found that some of them are "inquisitive" enough to use search to get ...
2
votes
1answer
118 views

Can you limit users visibility of salesforce content separately on mobile?

Like what if we just want our users to be able to access the calendar from the salesforce app. When they are in using their computer we want them to have full acess, but then when they are out and ...
1
vote
0answers
70 views

Visualforce change ws to wss in some orgs (localhost)

I have two sandboxes of different orgs. I am trying to open visualforce with same code: <apex:page > <script type="text/javascript"> var CONNECTION; window.onload = function ...
1
vote
1answer
698 views

Why the external and internal access for contacts should be same

As per Trailhead module (Link below), For contacts, you must set Controlled by Parent for both the default internal and external access. https://trailhead.salesforce.com/trails/communities/...
0
votes
1answer
52 views

Will Expired Managed Package prevent the access to standard object?

I'm facing the issue that none of my Org users can't create account since last 15 days. I've checked all privileges everything is fine even though the system administrator can't create account record. ...
2
votes
1answer
2k views

Lock sessions to the IP address from which they originated

After enabling "Lock sessions to the IP address from which they originated" still able to login to workbench in same session and callouts are also working. Didn't understand the working of it.How does ...
1
vote
1answer
126 views

can we encrypt %%emailaddr%% while passing to a page?

we pass %%emailaddr%% to a webpage as query string value. Can we encrypt the email on email send and webpage can decrypt it so email is never exposed? NOTE: In this case webpage is a 3rd party site ...
16
votes
1answer
5k views

Use a Named Credential with API key?

I want to be able to make callouts to JotForm, but they do not support OAuth and username/password is insufficient for their API. Here are their docs; for reference, here are the 3 auth options: ...
2
votes
1answer
614 views

LightningSelfRegisterController appears to be running in User context; shouldn't it run in System context?

I'm customizing the LightningSelfRegisterController shipped with Lightning Communities. I was surprised to learn that a query didn't return the results I was expecting, seamingly due to the context in ...
1
vote
2answers
1k views

Salesforce OWD and Profile settings?

I am confused with OWD and Profile. If an Object is set as Public Read-Only at OWD level and give write permission at Profile level, can the user edit the records? Is this the way to override OWD ...
0
votes
1answer
73 views

How to troubleshoot missing user privileges?

We are trying to invoke a describeSObject via SOAP Api on a custom object for a specific user, and the call fails with: sObject type "MyObject__c" is not supported. If you are attempting to use a ...
1
vote
1answer
974 views

Access to leads for customer community users

This is a generic question. Is there any possible way to give visibility to leads to a customer community user. In the below article https://help.salesforce.com/articleView?id=networks_visibility....
0
votes
1answer
210 views

Download attachments from associated records - Community

I have a community where users can raise cases, attach logs, etc. A user can be a customer or a partner - where partner doesn't always have partner community license (users with customer community ...
1
vote
1answer
40 views

Site Guest User Debugs

While working on a custom visualforce community, we noticed the guest site user login attempt is being captured. We were expecting a cookie (https://releasenotes.docs.salesforce.com/en-us/winter17/...
3
votes
1answer
703 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
0
votes
0answers
85 views

Enetrprise wsdl only for login and security

I exposed an apex class to an external system from salesforce, I read that I have to give the external system custom wsdl and enterprise wsdl. can I provide the enterprise wsdl to an external system ...
0
votes
1answer
437 views

Why can Portal user see custom object?

I have Org-Wide Defaults set to Private/Private with Grant Access Using Hierarchies unchecked on a custom object. I have a sharing rule that says users may read the object if it is marked Active = ...
1
vote
2answers
45 views

Record access for limited time

How would I automatically provide access to a Person Account record for only 15 minutes, if the user answered a security question correctly and then have it automatically revoked? Scenario: ...
3
votes
2answers
3k views

How to pass Schema.SObjectType to a class method as an argument?

In an effort to write reusable code, I am trying to move my field-level security check code into a common class/methods. Because the Schema.SObjectType is dynamic, I am looking for a way to pass ...
-1
votes
1answer
29 views

How to hide accounts/contacts from other members in same org but different project?

My client has two distinct project in one SF instance. Ideally, neither project should see each other's accounts and contacts. What would be a good way when creating an account or contact to make ...
1
vote
2answers
28 views

How to set particular session for end user

In my org some end users are there, i have to set timeout for 30 mins. After 30 mins it will logout forcefully. Can we set different session timings for different end users. Is it possible, if it is ...
3
votes
0answers
162 views

System Authenticated Redirection - redirecting to login page over and over

I'm trying to set up a 'System Authenticated Redirection' microsite in Marketing Cloud. Even though I'm logged in, it keeps redirecting me to the login page. I enter my details over and over again, ...
3
votes
0answers
1k views

To enable Require secure connections (HTTPS) for all third-party domains

I have to increase the security level of my org. I know that if I activate "Require Secure Connections (https) for all third-party domains" I may have problems with pre-existing integrations. How can ...
2
votes
0answers
72 views

Crypto sign string using DSA private key in Salesforce

Colleagues, I'm doing integration using REST API with a service that requires a string signed by private key which uses DSA algorithm. The problem is in APEX Crypto class does not support DSA keys (...
-1
votes
2answers
638 views

Query: SOQL SOSL Injection in Security Review

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is: L 435: query += fmw.LeadFieldName + ', '; L 437: query = query.substring(0 , query.length()-2)...
2
votes
1answer
152 views

IsUpdateable returns true for Admin profile, even though I removed edit access

I am running checks on fields in my Apex controller, to see if the logged in user has update access on a field before allowing an update. While logged in as Admin, when I check IsUpdateable() in my ...
6
votes
1answer
134 views

Is there a zero-downtime way to rotate the server credentials used by force-wsc?

I use force-wsc to connect to the SOAP API with a username and password/security token in production. As a best practice, I rotate the password (and therefore the security token) on this server ...
2
votes
1answer
146 views

Store Firebase API Key in Salesforce

I'm looking for Best Practice how to store API Keys like Firebase in Salesforce. Situation For a Salesforce implementation data has to be pushed to Googles Firebase The API Key should not be visible ...
0
votes
1answer
42 views

Email with an attachment from Salesforce

When I create an email in Salesforce & add an attachment, I receive a popup warning message indicating that the attachment becomes public if I click the send button. I don't understand what this ...
0
votes
1answer
28 views

Contact visible to user - how?

Our sharing setup is such that Accounts are private OWD and sharing rules are in place for role hierarchy based sharings and no other sharing criteria Contacts are marked as "Controlled By Parent" - ...
0
votes
3answers
1k views

How to stop users from deleting Activities?

We have accounts OWD set to Private and OWD for Activities set as Controlled by Parent but people can still delete their activities on the Account for example if a call doesn't go well. How can I ...
1
vote
0answers
136 views

Two Factor Authentication without login flows,Authenticate app and free of cost

Hi I have to know is there is any Two Factor Authentication approach for sales force,which doesn't contains any login flows,Authentication app and with free of cost for third party applications like ...
5
votes
1answer
664 views

SalesForce response to recent CPU Vulnerabilities

Has anyone seen a response from SalesForce yet around the recent "Meltdown, Spectre". The severe design flaw in Intel microprocessors that allows sensitive data, such as passwords and crypto-keys, ...
1
vote
0answers
308 views

Where I can store access and secret keys for callouts to AWS SQS service? Should I use Named Credentials or other means suit better for this case

This question has an answer to how to send request to Amazon SQS service from Apex. However, I am concerned that we have to expose access and secret keys in the code. Is this possible to use Named ...
1
vote
0answers
22 views

Is it possible to allow non-admin users to manage Email Alert recipients?

My client would like certain users to have the ability to manage Email Alert recipients. Right now their org is to setup to send to specific users, but if we had to, we are willing to setup Public ...
2
votes
1answer
63 views

Security Review on links to webpages from external application

I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame. My external application contains links to external websites ...
0
votes
1answer
218 views

Are Multiple API Users Required to Restrict Access to Specific REST Endpoints? Can we limit based on Connected App info?

Based on this question: Securing a REST API and this one How to limit an access to specific REST endpoint? it seems that the only way I can limit access to specific custom endpoints is to create ...
4
votes
1answer
323 views

Can FeatureManagement.changeProtection() be used to Protect any Custom Object?

Winter 18 introduced the FeatureManagement Apex Class, which contained a method which I was not expecting: changeProtection. According to the docs, changeProtection can be used to "Unprotect" objects ...
1
vote
1answer
31 views

How can I send third party user login information from salesforce to a target API securely?

I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as ...
0
votes
1answer
103 views

User creating case record not being able to view the case

I have a user who has created a new Case Object record. The user has Read/Write/Create access for his profile for Case. The org-wide settings for Case is Private. The Case owner is a different user(...
0
votes
0answers
335 views

How to make CSS of lightning bundle dynamic

I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows: Markup: <style aura:id="tooltipStyle"&...
0
votes
2answers
887 views

How to share a record with a community user?

I'm trying to share a record for a community user programatically. Tried below code in Execute anonymous. // Create new sharing object for the custom object. myObject__Share objShare = new ...
0
votes
0answers
19 views

Date Specific Field Level Security with Formula Validation

I want to create field level security on certain fields after the 10th of the following month for all ClosedDates within one month for everyone but finance people. For example, if a ClosedDate is in ...
0
votes
1answer
353 views

SurveyForce 'X-Frame-Options issues in Communities

We are trying to use SurveyForce for communities (Visualforce + Tabs), but I am having trouble with iFrames. For a System Admin, when he logs into the Community, it works perfectly fine. Preview in ...
0
votes
0answers
71 views

Possible Security concerns when exposing access through force.com sites

I have designed an unsubscribe functionality for Contacts in our org and I am a bit concerned about any potential security vulnerabilities this might lead to and how I can make the design more secure. ...
1
vote
0answers
381 views

What is the impact of sslverify and strict-ssl for salesforcedx?

In the documentation for installing salesforcedx behind a firewall ( https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_install_cli_firewall.htm ) it suggests we ...
1
vote
1answer
207 views

Showing HTML contents in Managed Lightning Component

We have developed a Managed Grid component where users can dynamically pass column definition and data which will be rendered as SLDS table. We support datatypes such as Text,Date,DateTime.. so on. ...
0
votes
1answer
51 views

Securely handle Salesforce Access token after OAth

We are developing an angular2 app which authenticates with Salesforce via OAth's user-agent flow. As of now, we are storing the "access token" in the browser's local storage. The main problem we are ...
5
votes
1answer
101 views

Salesforce angular security concern

We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are ...
4
votes
1answer
51 views

How to check from Apex code if custom setting is protected?

The question is simple: Is there any way to figure out from Apex code if custom settings is marked as protected or not? Looking through DescribeSObjectResult cannot find any single method related to ...

1
3 4
5
6 7
15