New answers tagged

3

Even if you could reliably authenticate that the incoming call came from a Visualforce page the next step would be to invoke the Javascript Remoting API from something like the browser's developer console. This is arguably easier than using fiddler, since it's using the exact same tools as your intentional Javascript remoting invocations. Attempting to ...


2

If you can't tighten up security that way, you could at least encrypt the data you're using, making it challenging for anyone to do anything with it. For example, consider the following: public String encryptParam(String key, String value) { Blob key = Crypto.generateDigest('SHA256',Blob.valueOf(UserInfo.getUserId()+key)); Blob enc = Crypto....


3

sObject#isSet is a method that simply tells you if the field is set to a value. Returns information about the queried sObject field. Returns true if the sObject field is populated, either by direct assignment or by inclusion in a SOQL query. Returns false if the sObject field is not set. If an invalid field is specified, an SObjectException is thrown. It ...


0

You should test all of your VF pages, components, images, etc to make sure that everything is displaying correctly. Ideally, when you enable this feature, you should see no actual changes; its primary function is to make the session more secure in some situations (e.g. proxy servers that log URLs would log a GET session ID, but not a POST session ID). This ...


2

It is Keylogging and Phishing. Because these other attacks can be avoided with different ways - Dictionary attack This can be avoided by using complex password policies and a number of attempts. With Salesforce, in the session setting, you can configure same policies. Man-in-the-middle attack This is more concerned related to network security than the ...


Top 50 recent answers are included