7 votes

How to prevent other people to unsubscribe on behalf of the subscriber?

You can't prevent this. Should I forward my email to you, you will indeed be able to click the Unsubscribe link, and unsubscribe on my behalf. There are no recommended ways of preventing it, but there ...
user avatar
  • 17.1k
5 votes
Accepted

LWS - Apparent difference in behavior using data returned from Apex call

Edit: This will be fixed in Spring 22, as confirmed by engineering. The original answer will remain below. In Locker Service (LS), they use an ObservableMembrane with a readOnlyMembrane within it ...
user avatar
  • 438k
4 votes
Accepted

Marketing Cloud SSL DIY Setup Cheaper?

Even though it's possible, I will discourage you from bringing your own SSLs for a number of reasons: You can only provide your own certificates for click/view/cloud page urls hosted on the SFMC ...
user avatar
  • 17.1k
3 votes

How to deal with the security of odd standard fields?

How we do this in our app is to determine if a field is required, then use Security.stripInaccessible to remove inaccessible fields, compare it to our list of required fields, and surface an error ...
user avatar
  • 438k
3 votes

How to exempt Automated Testing Users from MFA requirement?

The SFDC MFA FAQ states Is MFA required for RPA or automated testing accounts? No, accounts for test automation tools, such as Selenium™, Cucumber™, or Appium®, and Robotic Process Automation (RPA) ...
user avatar
  • 63k
3 votes
Accepted

Does workbench store or cache data anywhere outside of Salesforce?

The workbench is written in PHP. As such, uploads and downloads will be temporarily stored in various files stored on the workbench server. These files will be automatically purged periodically, and, ...
user avatar
  • 438k
3 votes
Accepted

FLS Create Security Risk still appears even though object is checked if it is creatable

Fields and objects each have their own security. You are expected to check every object and field, e.g. MyCustomObject__c.field1__c.getDescribe().isCreateable(). You can simplify these checks with ...
user avatar
  • 438k
2 votes

Access to account team member object

Based on docs Account team access is only visible if the user having below access, Edit access on account record. User is an Account owner or User need to available in above/parent Role of the ...
user avatar
  • 1,082
2 votes

Workbench - CVE-2021-44228

If workbench is using that Java library in the backend, it would have to be patched there (on the server), nothing you could do from your side. But I doubt that Workbench is affected, it seems to be ...
user avatar
  • 171
2 votes

Lightning Web Security breaks LWC with svg use tag

I quickly reproduced this on what you shared - but, I had no issue with this code once I added a check to make sure svg is not null as I assume it has no value initially. <template if:true={svg}>...
user avatar
2 votes
Accepted

How often does Salesforce change the keys at https://login.salesforce.com/id/keys?

I cross-posted this question to https://trailhead.salesforce.com/en/trailblazer-community/feed/0D54S00000GzB9Z and received the following answer from Sam Rosen, a Director on the Salesforce Identity ...
user avatar
  • 2,092
2 votes

Visualforce and LWC Security Concerns

Security Vulnerabilities in Salesforce (LWC, Visualforce or Apex) can occur in various forms, if the secure coding practices are not adhered to. It can be Cross Site Scripting, Cross Site Request ...
user avatar
  • 4,932
2 votes
Accepted

How can I stop Email Preview from executing API calls?

The solution here would be to wrap your API call in a conditional statement and utilize the messagecontext personalization string to determine the context in which the content is resolved: %%[ IF ...
user avatar
  • 10.6k
1 vote
Accepted

SFDC's out-of-the-box email to case security standards

Where can I find an appropriate description and proof that our SFDC instance is using encryption on this email tool? TLS and security for emails and 'Email-to-Case' covers the general description of ...
user avatar
  • 438k
1 vote
Accepted

How to control edit access to Role?

Step 1. Go to sharing settings > edit > Disable option "Grant Access using hierarchies Step 2. can Assign same permission set as Sales rep A and B
user avatar
1 vote

SalesForce Workbench Architecture

The code for Workbench is publicly available here. The tool is currently in maintenance-only mode, with only security and API updates and no new features. It is not a Salesforce product and you cannot ...
user avatar
1 vote

SalesForce Workbench Architecture

The Workbench has access to anything the user has access to. This is how the Salesforce API works in general. You must set up your user's Profile and Permission Set settings, as well as any sharing ...
user avatar
  • 438k
1 vote

How is attachment access controlled by record level

If I had to guess, this is the missing (ContentDocument)Link (seriously, I've waited ages to use this pun). Depending on the ShareType, the file might not be visible to people who can view the related ...
user avatar
  • 438k
1 vote
Accepted

API Enabled User Use Which Sharing ? Extenal Default or Internal

External OWD is about access for Experience Cloud (aka Community) users. For example, if license of an integration user is Salesforce, it is an automatically an Internal user, and Internal OWD are ...
user avatar
  • 4,169
1 vote

LWS - Apparent difference in behavior using data returned from Apex call

The team is actively investigating this suite of issues with Lightning Web Security and looking at possible ways to allow the data modification behavior as experienced Lightning Locker in the past in ...
user avatar
1 vote
Accepted

WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL

You don't need both. If you use WITH SECURITY_ENFORCED, you'll get an exception thrown if any fields are not readable by the user, while with Security.stripInaccessible, you'll simply remove any ...
user avatar
  • 438k
1 vote
Accepted

Will record data be visible via API if shared using sharing records with Guest User on Communities?

My question is if the records are shared via Sharing Rules with the Guest user, can calls be made to the Salesforce API in any way to access this shared data without a Salesforce username and password ...
user avatar
1 vote

Re-enabling the ability to impersonate External Users via "Log in to Experience as User" button (Spring 21)

This worked for me (this assumes you're logging into the experience from the person account/person contact record). You can also use permission sets to control access to the custom 'Log into ...
user avatar
  • 113
1 vote

How to permanently get rid of sandbox new/refresh email-address pollution with "@example.com"

Here's the best way I found to do it: Create a custom metadata type called Internal_User with fields User_Id__c and Email__c. Add your internal users (devs, admins, etc) as records on the custom ...
user avatar
  • 113
1 vote

Best Practices for Storing API Key?

It’s impossible to secure API keys when they are exposed to Javascript. I’m not going to dig into details since the answer is available online. If security is really a concern, you will need to fetch ...
user avatar
1 vote

Is it ok to store a bearer token in a custom field in the user object

You'll want to read Secure Coding: Storing Secrets. It is recommended that you use a Custom Setting that is Protected so that the secret cannot be used outside of your app's code. Other alternatives ...
user avatar
  • 438k
1 vote

Is there a security hole in Salesforce's documentation?

This code should not be used to authenticate a user with the web server, only to enable API access to the specified community. In that context, your proposed attack won't allow any access, as the ...
user avatar
  • 438k
1 vote
Accepted

Salesforce Backup Process

In terms of what's available to you for free, the Best practices to backup Salesforce data lists: Data Export Service: Manual or scheduled exports of your data via the UI. Export Backup Data from ...
user avatar
1 vote
Accepted

What is isCreatable and isUpdateable for FIELDS in GUI

Createable means that the user can put a value in this field when they are creating a new record. Updateable means that the user can put a new value in this field when they are editing a record. If a ...
user avatar
  • 438k

Only top scored, non community-wiki answers of a minimum length are eligible