0

The Situation: We need to reference a non Salesforce-Object in Chatter Posts, regardless of the Client Software (Mobile Browser / Salesforce App / Desktop Browser). The Ressource we want to reference is not part of the Salesforce-Universe as an Custom Object, but there are identified by an unique Id.

Background: The Ressource is a document, which we dont't want to be part of Salesforce Files and we don't want to transfer the document through the Salesforce Server.

We have an own Package installed which is able to access these Id by calling our own Service REST Endpoint using JS (Third Party Service - not part of Salesforce).

The Idea is to use Links. We could directly address the third party REST Service, BUT: Authorization.

  1. If the user has no valid Session-Cookie the call will not be processed
  2. Salesforce-App: Links are oppened in an clear Browser Popup, which never has a valid Session-Cookie. The Salesforce-App does not share Cookies with this Browser.

Our Solution (Idea): Using Link to an Lightning Page with a Apex Controller, which manipulates the Lightning-Page (including JS which will generate a Session-Cookie if necessary). The Lightning Page will then access the Third Party Ressource (also using JS).

Is there any better Idea?

Improve this question

1 Answer 1

Reset to default
0

I am not a big fan of storing session-cookie in JS. Plus it open one up to risks.

Why not do server-server communication, this way you don't accidentally expose any confidential credential in javascript/browser than can be sniffed by browser tools or Wireshark.

Do the call to third party service in apex and get document blob/base64 string, then in your lightning-webcomponent display that document in iframe somewhat like this

By this you are not storing document in server, and its safe from security point of view

Improve this answer
2
  • Thanks for your Answer. To your response: 1. JS does not store the Session-Cookie. Aktually it has the Credentials anyway and will do a Login, which will create a Session-Cookie. JS is not allowed (if not explizit allowed by CORS-Headers) to access Cookies at all. The Browser itself manage Cookies. In that case the JS does the login --> got Cookie. Request the document --> Browser automatically sends Cookie. 2. Why not Server: Data Protection Rules of Companies outside from Europa. Commented Sep 24, 2019 at 11:39
  • 3. Expose Credentials: Well, if wireshark is in place, sorry, then all Credentials could be exposed --> SEssion-Cookie is "the same" as a bearer-Token, .... Credentials are allways transmitted in some kind. Thats a Client issue, every Client has (App, Computer App, Browser,... ) 4. "By this you are not storing document in server": thats true, but streamed through. Commented Sep 24, 2019 at 11:41

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.