function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Sahil Bansal 7Sahil Bansal 7 

Security Review Issues : Canvas App

Hi Folks,

We have built a managed package containing the canvas app that uses "Signed Request". The canvas app is further rendered on a vf page using <apex:canvasApp> tag.

But the package didn't pass the security review with the following errors at "HTTPS" URLs:
  1. Authorisation : 
    1. Notes : Insecure object reference in the given function let a normal user to access to every user information in the database. Even the users from other organizations. Email, password, token, salts...
  2. CSRF : https://sample.com/account/logout
    1. Notes : Logout function has any kind of CSRF protection
Though I was reported with no error when I ran ZAP scan.

I also tried running BURP but no success
Can anyone help to resolve or replicate these reported issues?