Salesforce Apex security best practices

when developing in Salesforce Apex, writing secure code is essential to safeguard sensitive data and to ensure that your organization is protected against potential threats. Here’s a tutorial on how to write secure code in Salesforce Apex:

1. Understand Salesforce Security Model:

Before diving into secure coding practices, understand Salesforce’s core security features:

• Object-level security: Defines which objects a user can access.
• Field-level security: Determines which fields within an object a user can access.
• Record-level security: Defines which individual records a user can view and modify.

2. Use SOQL for Loops:

Instead of retrieving all records and then filtering them in Apex, use SOQL queries to retrieve only the necessary records. This reduces the risk of hitting governor limits and protects data from unnecessary exposure.

3. Avoid SOQL Injection:

Just like SQL injection in traditional web applications, Apex is susceptible to SOQL injection. Use String.escapeSingleQuotes() to sanitize user inputs:

String userInput = 'Test';
String query = 'SELECT Id FROM Account WHERE Name = \'' + String.escapeSingleQuotes(userInput) + '\'';

 

4. Check for CRUD and FLS:

Before executing any operation on an SObject or its fields, ensure you have the necessary CRUD (Create, Read, Update, Delete) and FLS (Field Level Security) permissions:

if (Schema.sObjectType.Account.isAccessible()) {
    if (Schema.sObjectType.Account.fields.Name.isUpdateable()) {
        // Perform the update operation
    }
}

5. Secure Web Services:

If you’re exposing a web service, validate the input and output data. Ensure you’re only sharing the necessary data, and validate the data types and values against expected formats.

6. Avoid Hardcoding IDs:

Hardcoded IDs can change between orgs (sandbox to production, for instance). Instead, use dynamic methods to retrieve necessary values.

7. Use With Sharing:

Always use with sharing when declaring a class unless there’s a justified reason not to. This enforces the user’s object-level and record-level permissions.

public with sharing class MySecureClass {
    // Your code here
}

8. Limit Visibility of Apex Classes:

By default, Apex classes are global. Use public or private to limit the visibility of your class unless it needs to be exposed to other Salesforce applications or external systems.

9. Store Secrets Securely:

Never hard-code credentials or secrets in your Apex code. Instead, use Named Credentials, Custom Settings, or Custom Metadata types, ensuring they’re encrypted and not directly accessible by the end-users.

10. Handle Exceptions Properly:

Always have exception handling in place to prevent exposure of sensitive data or system information. Use try-catch blocks and log the errors without revealing too much information to the end user:

try {
    // Your code here
} catch (Exception e) {
    System.debug('An error occurred: ' + e.getMessage());
    // Show a generic error message to the user
}

11. Regularly Review Security Reports:

Salesforce provides security scanning tools that analyze your Apex code and Visualforce pages. Regularly use these tools to identify and fix potential vulnerabilities.

12. Stay Updated:

Stay updated with Salesforce releases and security best practices. Salesforce releases updates thrice a year, often with new security features and recommendations.

13. Test Thoroughly:

Lastly, always test your code under various profiles and permission sets to ensure that it’s behaving as expected. Automated test methods can help ensure continuous compliance with security best practices.

By following these practices and regularly reviewing and updating your code, you can ensure that your Salesforce Apex code is secure and robust against potential threats.

 

 

Schedule Apex in Salesforce: A Technical Guide for Developers

Common Apex String Methods

Speeding Up Apex Test Execution: A Guide for Faster Salesforce Deployments