SKUID Based Public Salesforce Sites and Security Concerns For a public access site that is using a SKUID page to display information, what security concerns come up and how can they be addressed?
If I have a page that receives a passed ID to do a query, someone can potentially pass a different ID and get information from that ID that they shouldn’t necessarily see. I can perhaps secure this using a “token” along with the ID to run the query, which is my current line of thinking, but what other things might someone exploit on a SKUID public site? Could they somehow (using javascript perhaps) modify the query to remove that token condition?
I could set up Salesforce object level permissions to be more aggressive, but in doing so it would really be an all or nothing on a per object basis rather than only allowing the user to query for information specific to them. Let’s say I want to expose the Invoice object to customers through the public site, but only want customers to be able to view their own invoices; how can this be secured? If we set up