FAQ-000437 - Connected App Security / Security Review and Compliance

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
How should Connected Apps be implemented to meet security review requirements and avoid vulnerabilities?
Answer
To ensure Connected App implementations meet security review requirements and avoid vulnerabilities, follow these comprehensive practices: **Secure Authentication Implementation:** 1. **Use OAuth 2.0**: Use OAuth 2.0 for authentication and avoid using session IDs for external API calls 2. **JWT Authentication**: If using JWT authentication, securely store private keys in protected custom settings or metadata 3. **Proper Access Controls**: Implement proper access controls and limit the app's scope to least privilege necessary 4. **Avoid Insecure Methods**: Do not use session IDs for authentication; use OAuth tokens instead **Component and Data Security:** 1. **Avoid Exposing Sensitive Components**: Do not expose sensitive components like Lightning Message Channels in managed packages, as they can pose security risks 2. **Secure External Endpoints**: Ensure all external endpoints use HTTPS for communication and avoid insecure HTTP channels 3. **Protect Sensitive Data**: Replace public custom metadata containing sensitive information with protected metadata objects to prevent public access 4. **Secure Storage**: Store sensitive data such as client secrets and access tokens securely using encryption and protected custom metadata or settings **OAuth Scope and Permission Management:** 1. **Define OAuth Scopes Carefully**: Ensure OAuth scopes are not overly permissive and follow the principle of least privilege 2. **Scope Impact Assessment**: If lowering the scope of the Connected App, ensure it does not impact the functionality of previous package versions 3. **Document Changes**: Document changes as false positives if necessary, with reasoning for the security review **Testing and Validation:** 1. **Thorough Testing**: Test your solution, including external endpoints, using manual and automated security scanning tools 2. **Address Vulnerabilities**: Address all identified vulnerabilities and document any false positives with proper reasoning 3. **Regular Updates**: Regularly review and update your implementation to align with Salesforce security guidelines and best practices **Documentation and Support:** 1. **Proper Documentation**: Document any changes to connected apps and mark them as false positives if they do not pose a security risk 2. **Salesforce Support**: Raise a case with Salesforce Support for guidance on specific implementation challenges 3. **Technical Office Hours**: Schedule technical office hours appointments with the AppExchange security review team through the Partner Security Portal **Deprecation Management:** 1. **Careful Deprecation**: If a connected app is no longer in use, deprecate it carefully to avoid breaking functionality for users of older app versions **Common Vulnerability Reasons:** Even recommended authentication processes might be flagged as vulnerabilities if they: - Use insecure methods like session IDs instead of OAuth tokens - Fail to implement proper access controls - Expose sensitive components or lack sufficient protection for sensitive data - Don't fully adhere to security best practices By implementing these practices carefully, you can ensure your Connected App meets all security guidelines and protects sensitive information effectively.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
LimitConnectedAppScopeUseHttpsCallbackUrlConnectedAppAvoidApiSessionIdAvoidUnauthorizedApiSessionIdInApexAvoidUnauthorizedApiSessionIdInVisualforceAvoidUnauthorizedGetSessionIdInApexAvoidUnauthorizedGetSessionIdInVisualforceApexInsecureEndpointAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInVarDeclsAvoidHardcodedCredentialsInVarAssignAvoidHardcodedCredentialsInHttpHeaderApexSuggestUsingNamedCredProtectSensitiveDataAvoidChangeProtectionUnprotectedAvoidLmcIsExposedTrueAvoidInsecureHttpRemoteSiteSettingAvoidDisableProtocolSecurityRemoteSiteSetting
Question
How should Connected Apps be implemented to meet security review requirements and avoid vulnerabilities?
Recommended Answer Update
To ensure Connected App implementations meet security review requirements and avoid vulnerabilities, follow these comprehensive practices: **Secure Authentication Implementation:** 1. **Use OAuth 2.0**: Use OAuth 2.0 for authentication and avoid using session IDs for external API calls 2. **JWT Authentication**: If using JWT authentication, securely store private keys in protected custom settings or metadata 3. **Proper Access Controls**: Implement proper access controls and limit the app's scope to least privilege necessary 4. **Avoid Insecure Methods**: Don't use session IDs for authentication; use OAuth tokens instead **Component and Data Security:** 1. **Avoid Exposing Sensitive Components**: Don't expose sensitive components like Lightning Message Channels in managed packages, as they can pose security risks 2. **Secure External Endpoints**: Ensure all external endpoints use HTTPS for communication and avoid insecure HTTP channels 3. **Protect Sensitive Data**: Replace public custom metadata containing sensitive information with protected metadata objects to prevent public access 4. **Secure Storage**: Store sensitive data such as client secrets and access tokens securely using encryption and protected custom metadata or settings **OAuth Scope and Permission Management:** 1. **Define OAuth Scopes Carefully**: Ensure OAuth scopes aren't overly permissive and follow the principle of least privilege 2. **Scope Impact Assessment**: If lowering the scope of the Connected App, ensure it doesn't impact the functionality of previous package versions 3. **Document Changes**: Document changes as false positives if necessary, with reasoning for the security review **Testing and Validation:** 1. **Thorough Testing**: Test your solution, including external endpoints, using manual and automated security scanning tools 2. **Address Vulnerabilities**: Address all identified vulnerabilities and document any false positives with proper reasoning 3. **Regular Updates**: Regularly review and update your implementation to align with Salesforce security guidelines and best practices **Documentation and Support:** 1. **Proper Documentation**: Document any changes to connected apps and mark them as false positives if they don't pose a security risk 2. **Salesforce Support**: Raise a case with Salesforce Support for guidance on specific implementation challenges 3. **Technical Office Hours**: Schedule technical office hours appointments with the AppExchange security review team through the Partner Security Portal **Deprecation Management:** 1. **Careful Deprecation**: If a connected app is no longer in use, deprecate it carefully to avoid breaking functionality for users of older app versions **Common Vulnerability Reasons:** Even recommended authentication processes might be flagged as vulnerabilities if they: - Use insecure methods like session IDs instead of OAuth tokens - Fail to implement proper access controls - Expose sensitive components or lack sufficient protection for sensitive data - Don't fully adhere to security best practices By implementing these practices carefully, you'll ensure your Connected App meets all security guidelines and protects sensitive information effectively.
Reasoning
The answer content is comprehensive and technically accurate. I made minor wording improvements to enhance readability and flow without changing the structure or adding new information. Specific changes include: replacing 'Do not' with 'Don't' for a more conversational tone, changing 'does not impact' to 'doesn't impact', and 'Do not fully adhere' to 'Don't fully adhere'. I also changed 'can ensure' to 'will ensure' to be more direct and positive. These changes align with the brand guidelines for conversational language while maintaining all the original security guidance. The selected security rules directly relate to the FAQ content: - LimitConnectedAppScope: FAQ discusses limiting OAuth scopes and least privilege - UseHttpsCallbackUrlConnectedApp: FAQ mentions using HTTPS for external endpoints - AvoidApiSessionId and related session ID rules: FAQ specifically warns against using session IDs for authentication - ApexInsecureEndpoint: FAQ discusses securing external endpoints with HTTPS - Hardcoded credentials rules: FAQ covers secure storage of client secrets and access tokens - ApexSuggestUsingNamedCred: Related to secure credential storage mentioned in FAQ - ProtectSensitiveData: FAQ discusses protecting sensitive information in metadata - AvoidChangeProtectionUnprotected: FAQ mentions using protected custom metadata - AvoidLmcIsExposedTrue: FAQ specifically mentions not exposing Lightning Message Channels - Remote site security rules: FAQ discusses secure external communication
Reasoning References