function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
vbadhwarvbadhwar 

SFDC Security: Validate Legitimate SFDC SOAP servers

If you are integrating external (composite) apps with the Force.com platform, be sure to validate legitimate salesforce.com SOAP servers. Below is the regex to effectively implement this:
 
https://[^/?]+\\.(sales|visual\\.)force\\.com/services/(S|s)(O|o)(A|a)(P|p)/(u|c)/.*

Basically, this will ensure that the URL must start with ‘https://’, followed by a character other than ‘/‘ or '?' for 1 or more times, followed by a ‘.’, followed by ‘sales’ or ‘visual.’, followed by ‘force.com/services/SOAP/’, followed by ‘u’ or ‘c’, followed by ‘/’

It whitelists the following domains:

https://*.salesforce.com/services/SOAP/u
https://*.salesforce.com/services/SOAP/c
https://*.visual.force.com/services/SOAP/u
https://*.visual.force.com/services/SOAP/c
 
If you have any questions about this, please do not hesitate to contact me.

 

Varun Badhwar

Force.com Security Manager 

Message Edited by vbadhwar on 05-15-2009 10:07 AM
Message Edited by vbadhwar on 09-28-2009 10:20 AM
Message Edited by vbadhwar on 09-28-2009 10:21 AM
Best Answer chosen by Admin (Salesforce Developers) 
vbadhwarvbadhwar

Here you go:

https://[^/?]+\\.(sales|visual\\.|cs[0-9]\\.)force\\.com/services/(S|s)(O|o)(A|a)(P|p)/(u|c)/.* 

All Answers

DrawloopSupportDrawloopSupport

vbadhwar,

The RegEx you provided does not match this url that Salesforce uses for Sandbox sites:

 

https://xxxx.dev.cs0.force.com/SS/services/Soap/u/15.0/00DT0000000FsaU

 

Please provide an updated RegEx that will match that url.

Thanks.

Message Edited by DrawloopSupport on 10-29-2009 08:22 AM
vbadhwarvbadhwar

Here you go:

https://[^/?]+\\.(sales|visual\\.|cs[0-9]\\.)force\\.com/services/(S|s)(O|o)(A|a)(P|p)/(u|c)/.* 

This was selected as the best answer
DrawloopSupportDrawloopSupport

Varun,

Thanks, but unfortunately this RegEx still does not match the link posted. The problem is the /SS/. Also, this may not even matter because Salesforce does not have/maintain SSL certificates for these types of domains.

Thank you.