Table of Contents
Ensuring the security of your Salesforce instance is crucial to protect your organization’s sensitive data and maintain a safe environment for your users. In this guide, we’ll cover everything you need to know to enable Clickjack Protection for Customer Visualforce Pages effectively.
Understanding Clickjack Protection
What is Clickjacking?
Clickjacking, also known as UI redress attack or user interface redress attack, is a type of cyberattack where an attacker tricks a user into clicking on something different from what they perceive. The attacker conceals a malicious action or webpage beneath a legitimate one, leading to unintended actions by the user. In Salesforce, Clickjacking can pose a significant security threat, potentially leading to unauthorized access and actions within your organization’s Salesforce instance.
Why Clickjack Protection is Important
Clickjack Protection is a vital security feature that helps safeguard your Salesforce data and operations against Clickjacking attacks. It ensures that your Visualforce pages cannot be easily embedded within external websites or framed by malicious actors. By enabling Clickjack Protection, you mitigate the risk of attackers tricking your users into taking unintended actions within Salesforce.
Identifying Your Visualforce Pages
Custom Visualforce Pages
Before enabling Clickjack Protection, identify the custom Visualforce pages in your Salesforce organization that need protection. These are typically pages you’ve developed to meet specific business needs. It’s essential to have a list of these pages for reference.
Standard Salesforce Pages
Keep in mind that Salesforce already applies Clickjack Protection to its standard pages by default. However, you should still consider your organization’s specific requirements and potentially adjust settings accordingly.
Modifying Visualforce Pages
Adding the showHeader Attribute
To enable Clickjack Protection for customer Visualforce pages, you need to make a simple modification. In each Visualforce page’s definition, add the showHeader="false" attribute to remove the Salesforce header. This header removal reduces the risk of Clickjacking by making it more challenging for an attacker to overlay your page with a deceptive one.
Here’s an example of how to modify a Visualforce page:
<apex:page showHeader="false">
<!-- Your Visualforce page content goes here -->
</apex:page>Implementing Clickjack Protection Settings
Accessing Clickjack Protection Settings
To configure Clickjack Protection settings in Salesforce, follow these steps:
- Log in to your Salesforce organization with administrative privileges.
- Click on the gear icon in the top right corner to access the Setup menu.
- In the Quick Find box, type “Session Settings” or navigate to “Security” > “Session Settings.”
Configuring Clickjack Protection Settings
In the Session Settings page, locate the “Clickjack Protection” section. This is where you’ll configure the protection settings.
Clickjack Protection Levels
Salesforce offers two protection levels:
- Standard: This level provides a good balance between security and usability. It is suitable for most scenarios.
- High: High-level protection provides maximum security but can affect the usability of your Visualforce pages. Use this level if you have stringent security requirements.
Select the protection level that aligns with your organization’s security needs. For most cases, “Standard” is recommended.
Frame Embedding Options
You have two options for frame embedding:
- Allow framing by same origin only: This option allows Visualforce pages to be framed only by pages from the same domain (Salesforce). This is the most secure option but can limit certain integration scenarios.
- Don’t allow framing by any page: This option completely disables framing, providing maximum security. However, be cautious, as it can impact legitimate use cases like embedding Visualforce pages in external websites.
Choose the frame embedding option that best suits your organization’s security requirements. For enhanced security, “Don’t allow framing by any page” is recommended.
Testing Your Visualforce Pages
Functional Testing
Before deploying your Visualforce pages with Clickjack Protection enabled, thoroughly test them to ensure they function as expected. Verify that all features and functionalities are intact, and there are no unexpected issues.
Security Testing
In addition to functional testing, perform security testing to ensure that Clickjack Protection is effectively preventing any unauthorized framing or embedding of your Visualforce pages. You can use security testing tools and conduct vulnerability assessments to identify and address any potential weaknesses.
Monitoring and Ongoing Maintenance
Regular Security Audits
Security is an ongoing process. Regularly audit your Salesforce organization’s security measures, including Clickjack Protection settings. Ensure that they continue to align with your organization’s evolving security requirements.
Adjusting Clickjack Protection Settings
As your organization’s needs change or as new security threats emerge, you may need to adjust your Clickjack Protection settings. Salesforce provides the flexibility to modify these settings to meet your evolving security demands.
Educating Your Team
Training and Awareness
Lastly, educate your Salesforce administrators, developers, and users about Clickjack Protection and its importance. Raise awareness of potential security threats and best practices to ensure that everyone understands their role in maintaining a secure Salesforce environment.
By following this comprehensive guide, you can enable Clickjack Protection for customer Visualforce Pages in Salesforce effectively. This not only helps protect your organization’s sensitive data but also ensures a safer and more secure experience for your users. Stay vigilant, regularly review your security measures, and adapt to emerging threats to maintain the highest level of security for your Salesforce instance.