3
How we do this in our app is to determine if a field is required, then use Security.stripInaccessible to remove inaccessible fields, compare it to our list of required fields, and surface an error only if we're missing a required field, otherwise we just continue as normal with the removed fields. Also, as a practical matter, you should generally make new ...
2
This code should not be used to authenticate a user with the web server, only to enable API access to the specified community. In that context, your proposed attack won't allow any access, as the access token is only "valid" for the attack server.
It's always important to make sure that you understand the context for the type of code you're writing....
1
It’s impossible to secure API keys when they are exposed to Javascript. I’m not going to dig into details since the answer is available online. If security is really a concern, you will need to fetch the data in Apex.
In Apex, the best way to store your key without exposing it to the repository is by using custom metadata records as they are not visible to ...
1
You'll want to read Secure Coding: Storing Secrets. It is recommended that you use a Custom Setting that is Protected so that the secret cannot be used outside of your app's code. Other alternatives are also possible, so you'll want to check out your options.
Only top voted, non community-wiki answers of a minimum length are eligible