salesforce-security-basics

# Salesforce Security Basics ## Overview Security best practices for Salesforce integrations: Connected App configuration, OAuth scope management, field-level security, and credential rotation. ## Prerequisites - Salesforce org with System Administrator access - Connected App created in Setup > App Manager - Understanding of Salesforce security model (Profile, Permission Set, OWD) ## Instructions ### Step 1: Secure Connected App Configuration ``` Setup > App Manager > New Connected App: 1. Enable OAuth Settings 2. Callback URL: https://yourapp.com/oauth/callback (NOT localhost in prod) 3. Selected OAuth Scopes — USE MINIMUM REQUIRED: - "Manage user data via APIs (api)" — for REST/SOQL access - "Perform requests at any time (refresh_token, offline_access)" — for refresh tokens - DO NOT add "Full access (full)" unless absolutely necessary 4. Require Proof Key for Code Exchange (PKCE): Enable for public clients 5. Require Secret for Web Server Flow: Enable 6. IP Relaxation: "Enforce IP restrictions" (not "Relax IP restrictions") ``` ### Step 2: Credential Storage ```bash # .env (NEVER commit to git) SF_LOGIN_URL=https://login.salesforce.com SF_USERNAME=integration-user@yourcompany.com SF_PASSWORD=<from-vault> SF_SECURITY_TOKEN=<from-vault> SF_CLIENT_ID=<connected-app-consumer-key> SF_CLIENT_SECRET=<connected-app-consumer-secret> # .gitignore — ALWAYS include .env .env.local .env.*.local server.key # JWT private key *.pem *.key ``` ### Step 3: Use a Dedicate...