Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
21 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
sfdcfox's user avatar
  • 494k
12 votes
Accepted

OAuth interactions: do they count as API calls?

After hammering the login.salesforce.com endpoints today (and getting blocked a couple of times), I've established (at least to my satisfaction) that the OAuth interactions around granting access ...
Alex Tennant's user avatar
  • 13.6k
11 votes
Accepted

Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow

Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code. Check if your auth code is ending with "%3D%3D" replace that ...
Pranay Jaiswal's user avatar
10 votes
Accepted

oAuth - Introspection endpoint says a valid access token is inactive

The response of {"active": false} is only allowed in very specific context. From oAuth Introspection spec (RFC 7662): If the introspection call is properly authorized but the token is not active, ...
identigral's user avatar
  • 7,646
8 votes
Accepted

Username-Password OAuth Authentication for community users?

In the profile of the user make it as API enabled. I was able to log in using api inside the community using the below soap login call., <Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"...
Pranay Jaiswal's user avatar
7 votes
Accepted

Security Review Oauth Callback "Insecure Storage of Sensitive Data"

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for ...
Daniel Ballinger's user avatar
7 votes
Accepted

Salesforce OAuth 2.0 JWT Bearer Token Flow - Token Expiration

The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the ...
Derek F's user avatar
  • 62.1k
6 votes
Accepted

Difference between Authentication and Identity Provider

Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time. The main difference between Authentication Provider and Identity provider is - Identity Provider :...
Tushar Sharma's user avatar
6 votes

Pros and cons of user-agent flow vs web server flow

Coming back to answer my own question. The answers above were true at the time but IETF no longer recommends using User Agent at all. As well, Web Server flows have been updated to not require a ...
brezotom's user avatar
  • 1,087
6 votes

Cannot connect a Salesforce org using Authorize an org in VS Code

There's a different login flow that's intended for other devices where this local webserver setup isn't feasible, but it's actually a great way of dealing with this exact issue on desktops too! You ...
Matt Lacey's user avatar
  • 25.6k
6 votes
Accepted

OAuth Authorization Flow for AppExchange Packages

Yes From the doc: AppExchange Partners: Request Tokens on Your Customer’s Behalf Multitenant AppExchange partners that use web app integrations with Marketing Cloud must be prepared to ...
identigral's user avatar
  • 7,646
6 votes

oAuth - Introspection endpoint says a valid access token is inactive

Haven't found any documentation to support this, so it's just speculation, but based on the lack of any mention of an "active" parameter (outside of child sessions) in the documentation on ...
Derek F's user avatar
  • 62.1k
5 votes

Named Credentials - Refresh Token - Google APIS

In the Auth. Provider, set Provider Type to 'Open ID Connect' (not 'Google'), and in 'Authorize Endpoint URL' put 'https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=...
mmm321321's user avatar
  • 659
5 votes
Accepted

Server to Server JWT Authentication Certificate management

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair ...
LoG's user avatar
  • 161
5 votes
Accepted

OAuth implementation in SOAP API (C#)

I recently had some challenges adding a SOAP Header when creating a Universal Windows Platform (UWP) application in .NET against the SOAP based APIs. The problem was that the WCF tooling for ...
Daniel Ballinger's user avatar
5 votes
Accepted

Locking Down OAuth App Access in our Salesforce Org

I belive you are looking for API client whitelisting. You can get it enabled by raising a case with Saleforce. Please do verify how it impacts the current connected apps before enabling it. You can ...
manjit5190's user avatar
  • 8,033
5 votes

Why don't I get a new refresh token when I refresh an access token in Salesforce?

Access Tokens are governed through the global Session Settings or the Profile Session Settings, while Refresh Tokens are controlled via OAuth Access Policies. You simply reuse a Refresh Token as long ...
sfdcfox's user avatar
  • 494k
4 votes
Accepted

Canvas Signed Request vs OAuth flow

Signed request is completely secure while oauth flow is provided in case you want to do two way oauth and also alert the user that he is allowing access to the resources . When you do an oauth flow ,...
Mohith Shrivastava's user avatar
4 votes

Tie web server oauth to user session in my canvas app

This question is, effectively, asking the difference between authorization and authentication. OAuth 2.0 is an authorization standard. The access token you receive from the server authorizes you to ...
Christian Carter's user avatar
4 votes

(400) - Bad Request when requesting auth token using Wordpress

So I got it working. I had to change the Content-Type header to application/x-www-form-urlencoded, which I tried because of this answer. Unfortunately the docs don't tell you that. In fact they say ...
jabyess's user avatar
  • 71
4 votes
Accepted

What is the value of using an OAuth flow for your own external systems

Storing the username and password - Ultimately something has to be stored, and an access token can be used to access resources just as easily as a username and password. That's one point of view, but ...
sfdcfox's user avatar
  • 494k
4 votes

Metadata API: where is the Connected App / OAuth policies / Permitted Users setting?

As far as I can tell, it's not supported by the Metadata API. What's weird, however, is that there's no mention of permissions under ConnectedApp, which suggests that it is not supported, but it's ...
sfdcfox's user avatar
  • 494k
4 votes

Security Review Oauth Callback "Insecure Storage of Sensitive Data"

Insecure Storage of Sensitive Data refers to storage of passwords in insecure locations such as unencrypted custom fields or public custom settings. It has nothing to do with transport (even of ...
Robert Sussland's user avatar
4 votes

Pros and cons of user-agent flow vs web server flow

You are asking this question so you know that OAuth is used to grant an application access to Salesforce as a specific user. This application can be a server application (e.g. workbench, docusign) or ...
user1270665's user avatar
4 votes
Accepted

Google OAuth and UI - is is possible to pass back the authorization code not in the URL?

That approach should work - I've made this work with the refresh token to retrieve Google Analytics data each night. I store the refresh token in a setting, and when I need to access GA, I get a new ...
BritishBoyinDC's user avatar
4 votes

Is session duration guaranteed?

Separating your questions. My question is however, is this value of 2 hours guaranteed as a minimum session length? Will it always be at least 2 hours? Yes and No (No if a User ends the ...
Jayant Das's user avatar
  • 30.6k
4 votes

JWT Bearer flow vs. Username+Password flow in server-to-server integration

I think it is similar to why passwords in db are not stored in straight way, but hashed values are stored. In case, when someone not allowed will get access to it - he will not be able to operate with ...
Oleksandr Berehovskyi's user avatar
4 votes

Expired authorization code and Invalid Nonce errors

Basically, this error is saying that Salesforce has detected a "replay attack" scenario. A nonce is a random, unique value generated for each login attempt in certain login flows. If the same nonce is ...
sfdcfox's user avatar
  • 494k
4 votes

Custom REST controller to access Auth.AuthToken.getAccessToken returning null

Edited I did some tests with your code and setup in a Developer Org, Test 1: Log in as the user who created the Auth. Provider in Workbench Result: I can get the token in workbench. Test 2: Grant ...
Adam's user avatar
  • 469
4 votes

SFDX: Authorize an Org hangs after login attempt

Most of us have this issue with Authorization command. Something may be broken in cli. One workaround is with this command: // authorize production org sfdx auth:device:login // authorize sandbox ...
Raul's user avatar
  • 18.8k

Only top scored, non community-wiki answers of a minimum length are eligible