Hi All,
In our Managed Package we are storing password as encryptedtext in custom object. We got flag from Salesforce security review storing password in custom object is vulnerable suggested to store in custom settings and access via apex. But we are querying password field from its parent object and downloading as xml (Not sure how to reference(lookup) in custom settings to query). Can i use apex crypto class in Custom object(ie password filed to encrypt) without custom settings will solve this problem? Please advise.
Regards,
Afrose
Ok - If I'm understanding this correctly, there will be multiple username/password combinations that would need to be stored and queried?
If that is correctly, you would create a custom setting. Specifically, a protected custom setting. For example, you can create "userpass__c".
You can then retrieve all the custom setting values with a call like:
userpass__c u = userpass__c.getAll().values();
Or you can set up you data by "keys" so that each custom setting is a named custom setting. You can then retrieve the specific setting with something like:
userpass__c u = userpass__c.getValues('User 123');