Forum Ambassador
ha fatto una domanda in #FlowHey All!
Had a conversation with @Michelle Dwyer regarding the pros and cons of different approaches of guest-facing Flows from a security perspective. Does anyone have an experience to share where they addressed the use case of a guest user needing enhanced access only for the Flow they are in (e.g. they are registering a device and need real-time feedback if that device was already registered, but don't have access to all device records in Salesforce)? Curious to hear what folks think about the different approaches and their security concerns, like elevating the access of the Flow to System Context or widening the access of the guest profile.
I would say it's likely safer to elevate access via System context (whether that's in flow or apex) rather than elevate access to the guest profile / guest user because granting access at a profile / platform sharing level opens up the possibility of returning data to calls / requests other than your intended UI.
I would also try to implement some sort of encrypted token for the session to use with your flow that's running in system context to make things more secure.
This should be a good read on some best practice patterns: https://www.learnexperiencecloud.com/article/Guest-User-Record-Access-Development-Best-Practices
