7

David is absolutely right and I'd like to add some extra information and provide code examples regarding Apex-encryption/C#-decryption. To encrypt some String in Apex using the AES256-CBC algorithm you can: Generate private key: final Blob privateKey = Crypto.generateAesKey(256); Store somewhere the generated key as a String: // System.debug(LoggingLevel....


7

You can't prevent this. Should I forward my email to you, you will indeed be able to click the Unsubscribe link, and unsubscribe on my behalf. There are no recommended ways of preventing it, but there are few options, if you really want to annoy your subscribers (and probably also violate your local legislation): You can trigger an email, asking the ...


6

You'll need to store the secrets in environment variables in your build system, and inject them just prior to initiating uploads of 2GP managed package versions. Your source tree would contain only some arbitrary token that is the replacement target. I'll keep this example somewhat abstract to account for differences in what CI or build system you actually ...


5

This is a normal part of the content security policy that Salesforce requires. Over the years this has become stricter (as online security tends to do). Mozilla's MDN web documentation on Content Security Policy also considers this a requirement. In that sense there's nothing left to do but place the inline CSS in an CSS file. The reason for this is ...


5

Enable Secure Static Resources for Lightning Components has been postponed indefinitely, as per the Summer 21 release notes: This release update has been postponed indefinitely while we change the implementation to reduce customer impact. The release update won’t be enforced in its present form. Don’t enable it. Unless Salesforce changes their mind in the ...


4

The data I would think an external systems developer would need are: The algorithm: AES256. The cipher mode: Cipher Block Chaining (CBC), as documented for the Apex Crypto class. The padding mode: PKCS7 (same link). The fact that you are using a managed initialization vector. The fact they you're transmitting the data in Base64. And of course, the key. ...


4

I belive you are looking for API client whitelisting. You can get it enabled by raising a case with Saleforce. Please do verify how it impacts the current connected apps before enabling it. You can use API Access Control to restrict users from accessing your Salesforce APIs, unless they're pre-authorized through an approved connected app. Connected apps ...


4

The best way to store credentials for basic authentication is storing them in Named Credentials. They provide the best security option here, since no one, including admin, cannot read the password from it. However, in some cases this is not an option, if a dynamic endpoint should be used. For ISV two additional options which support dynamic endpoint, are ...


4

Even though it's possible, I will discourage you from bringing your own SSLs for a number of reasons: You can only provide your own certificates for click/view/cloud page urls hosted on the SFMC platform, however, image urls must be secured via certificates obtained by SFMC (due to the nature of images being served by a CDN). You will still need to purchase ...


3

I suggest you bring this up in an office hour with the security review team and see what they suggest to be sure that your app won't fail the security review process. Now to answer it, Server to Server invocation Usually, the risk is very low if your connection is secured HTTPS from a theoretical perspective. In theory, an HTTPS connection does encrypt the ...


3

How we do this in our app is to determine if a field is required, then use Security.stripInaccessible to remove inaccessible fields, compare it to our list of required fields, and surface an error only if we're missing a required field, otherwise we just continue as normal with the removed fields. Also, as a practical matter, you should generally make new ...


3

The workbench is written in PHP. As such, uploads and downloads will be temporarily stored in various files stored on the workbench server. These files will be automatically purged periodically, and, as far as I can tell, can't be leaked across sessions. Technically, this may violate some IT or legal policies regarding data retention, even though this data ...


2

The new, modern way to do this is Security.stripInaccessible. This automatically checks all field level access, record level access, and object level access. It takes all the guesswork out of using describes and other security checks. You can still use WITH SECURITY_ENFORCED if you want an all-or-nothing approach, but Security.stripInaccessible will give you ...


2

You can't use Security.stripInaccessible() and WITH SECURITY_ENFORCED on the same query: SObjectAccessDecision securityDecision = Security.stripInaccessible( AccessType.READABLE, [SELECT Id, Status__c, Service_Appointment__r.Id, Service_Appointment__r.SA_Dispatched_SMS_Status__c FROM SMS__c WHERE Id IN :lstUpsertedSMSRecordIds WITH ...


2

I raised this with the Salesforce product manager for LWC Base Components and just got the following response: I just followed up with my team. The lightning-record-form component does not support time fields. I have asked the team to update the missing documentation. However, do note we are looking to add support for time fields in the upcoming releases. ...


2

After significant testing, I can confirm Salesforce uses the Standard Profile corresponding to your custom profile's license type to fill in the gaps when you create a profile with "incomplete" metadata. (updated with more complete info from @phil w's answer)


2

I've had no issues with Authy desktop (on a Windows 10 PC). You can add the salesforce account directly through the desktop app and get the token as well. I have it on my phone as well and I believe this is required (as it's connected to your phone number). Adding tokens/sites syncs across all your devices (Tablet, Phone, Desktop). It might also be worth ...


2

With 400 orgs that you potentially need to access, I assume you're using a password manager of some sort? As far as I know the market-leaders generally have MFA capabilities built in. Certainly using 1Password, I can log in to an org with a keyboard shortcut, and it automatically loads the current 2FA token into my clipboard. This is something we've had in ...


2

The SFDC MFA FAQ states Is MFA required for RPA or automated testing accounts? No, accounts for test automation tools, such as Selenium™, Cucumber™, or Appium®, and Robotic Process Automation (RPA) systems such as Automation Anywhere®, don't require MFA. These types of accounts aren't likely to be phished. But you should take precautions with the ...


2

If workbench is using that Java library in the backend, it would have to be patched there (on the server), nothing you could do from your side. But I doubt that Workbench is affected, it seems to be PHP / JS based. https://github.com/jdrishe/Salesforce-Workbench


2

Based on docs Account team access is only visible if the user having below access, Edit access on account record. User is an Account owner or User need to available in above/parent Role of the Account owner's role in Role hierarchy. Please let me know if it helps. Thanks.


2

Fields and objects each have their own security. You are expected to check every object and field, e.g. MyCustomObject__c.field1__c.getDescribe().isCreateable(). You can simplify these checks with Security.stripInaccessible.


1

This code should not be used to authenticate a user with the web server, only to enable API access to the specified community. In that context, your proposed attack won't allow any access, as the access token is only "valid" for the attack server. It's always important to make sure that you understand the context for the type of code you're writing....


1

In terms of what's available to you for free, the Best practices to backup Salesforce data lists: Data Export Service: Manual or scheduled exports of your data via the UI. Export Backup Data from Salesforce. Data Loader: Manual on-demand exports of your data via the API. Export Data. Report Export: Manual on-demand exports of your data via reports. ...


1

Createable means that the user can put a value in this field when they are creating a new record. Updateable means that the user can put a new value in this field when they are editing a record. If a user has Edit permission on a field, normally Createable and Updateable will both be true. However, there are times when this won't be true. For example, a ...


1

If possible, you should use Named Credentials with OAuth flow. There will be a one-time manual setup where you have to log in to the third-party OAuth server, but with a refresh token, it will automatically maintain an active session for you, even refreshing the access token if it expires. It's a very hands-off approach to authentication, and works well in ...


1

From official documentation here is the list of IP addresses that Salesforce uses https://help.salesforce.com/articleView?id=000321501&type=1&mode=1, including the one you pointed out. Some of them are really broad. You can try to test what IP ranges Salesforce uses for your location and try whitelist only them. You can also contact Salesforce ...


1

I'd highly recommened Authy by Twilio. I migrated from Microsoft Authenticator to Authy a few months back and they've fit my needs (multiple orgs, desktop-first) perfectly. Free of cost, No-ads and no 'premium' subscriptions.


1

It is generally not in the spirit of OAuth to be passing the client secret around as this is supposed to authenticate the client. But whether your system is exploitable depends on what you are doing. You say the client secret is encrypted -- how? And how is key management handled, and how is that wrapping key stored and distributed? How are you ...


1

Why does the Authorization header from the named credential take precedence over the Authorization header set in code? We can't necessarily answer why, but presumably, it allows an override for whatever the code may be doing. Note that all elements outside of Name, Label, and Endpoint are subscriber editable (in terms of Managed Packages). This means they ...


Only top voted, non community-wiki answers of a minimum length are eligible