12
votes
Accepted
How to OWASP ZAP scan external REST API using OAuth2
For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api ...
- 91.9k
4
votes
Security Review: Cloud Service uses and stores OAuth tokens
If part of App Exchange offering is an external app, it will be checked by Security Team the same way the Salesforce App is checked so:
you need to perform a security scan (Chimera or Zap), fix ...
- 91
4
votes
How to OWASP ZAP scan external REST API using OAuth2
If the accepted answer is too detailed for you, here is a short summary of what was important for me:
ZAP is the right tool. But forget everything you read on Google on how to make it directly talk ...
- 38.2k
2
votes
Accepted
Question about Endpoint scanning (ZAP) for security review
For external endpoints , there are 2 types :
Endpoints owned by package publisher : Since package publisher owns the external endpoint, it needs Chimera scan as stated here.
Endpoints not owned by ...
- 2,231
1
vote
Scan report for custom REST service for security review. Is that mandatory?
As mentioned in Force guide, SF accepts only APIs for client apps to communicate and hence as a part of security review API-only app security review.
If app has callouts to any other application other ...
- 71
Only top scored, non community-wiki answers of a minimum length are eligible