function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
philbophilbo 

Web-to-Lead and Authentication

Hey,

Basic question re. web-to-lead.  If the Web-to-Lead form (as generated by Setup->Customize->Leads->Web-to-Lead->Create Web-to-Lead Form) is populated by a 3rd party website, then does it suffice to post it to the URL

https://test.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST"

(or "www.salesforce.com", or whatever)

with the Org Id specified in the form

<input type=hidden name="oid" value="orgId">

Wouldn't there need to also be some sort of authentication?  If not - wouldn't it suffice to just change the orgId in the above, and have your Leads suddenly directed to a whole other org?

Clearly I'm missing something.  Can anybody set me straight on this?

Thanks!
Best Answer chosen by Admin (Salesforce Developers) 
philbophilbo
OK, so be it.   :^}

In testing W2L against  our sandbox, we found we had to change the endpoint from 'test.salesforce.com' to 'csX.salesforce.com' (csX being our particular sandbox server) in order to intake the Leads properly - leaving it as 'test' brings us up against a SF login screen.  Is this expected behaviour?  More importantly, is this something we should expect to look out for when we move to our production org?

Thanks!

All Answers

werewolfwerewolf
No, the whole point of W2L is that it's unauthenticated.  If you want an authenticated W2L you can turn off W2L in your org and make a PHP page or the like that takes the data and submits it via the web services API.

I suppose someone could sort of hack W2L by changing the orgId in there (if he happens to know another orgId), but I've never heard of anything like that actually happening.
philbophilbo
OK, so be it.   :^}

In testing W2L against  our sandbox, we found we had to change the endpoint from 'test.salesforce.com' to 'csX.salesforce.com' (csX being our particular sandbox server) in order to intake the Leads properly - leaving it as 'test' brings us up against a SF login screen.  Is this expected behaviour?  More importantly, is this something we should expect to look out for when we move to our production org?

Thanks!
This was selected as the best answer
RozRoz
ooh!  We're having the same problem at the moment.

I look forward to any advice on the matter.

Roz

:robotwink:
RozRoz
Actually, it was very simple as previously stated.

A simple matter of altering the URL in the W2L form to match the Sandbox URL.

:)