tools-only Security Checklist for Connected Apps & ECAs
Use this checklist before deploying any OAuth application to production.
Pre-Deployment Checklist
OAuth Configuration
- Callback URLs are specific (no wildcards)
- All URLs use HTTPS (required for production)
- PKCE is enabled for public clients (mobile, SPA)
- Consumer secret is protected (not in source control)
- Minimal scopes selected (principle of least privilege)
- No deprecated scopes in use
Token Policies
- Access token expiration is configured appropriately
- Refresh token policy matches use case
infiniteonly for trusted server applicationsspecific_lifetimefor user-facing appszerofor JWT Bearer flows
- Token rotation enabled for ECAs in production
- IP restrictions configured for server-to-server apps
Access Control
- Admin pre-authorization required for sensitive apps
- User assignment via Permission Set or Profile
- Connected App policies reviewed in Setup
- High Assurance session required if needed
External Client Apps (Additional)
- Distribution state correctly set (Local vs Packageable)
- Consumer key rotation enabled for production
- Consumer secret rotation enabled for production
- Policies file reviewed after first deployment
Security Scoring Criteria
Critical (Block Deployment)
| Issue | Impact | Fix |
|---|---|---|
| Wildcard callback URL | Token hijacking | Use specific URLs |
| HTTP callback URL | Credential interception | Use HTTPS only |
| Full scope without justification | Over-privileged access | Use minimal scopes |
| Consumer secret in code | Credential leak | Use environment variables |
High Priority
| Issue | Impact | Fix |
|---|---|---|
| PKCE disabled for mobile/SPA | Auth code interception | Enable PKCE |
| No IP restrictions (server) | Unauthorized access | Configure IP ranges |
| Infinite refresh tokens (user app) | Long-term compromise | Set expiration |
| No token rotation (ECA) | Compromised credentials | Enable rotation |
Medium Priority
| Issue | Impact | Fix |
|---|---|---|
| Missing description | Audit difficulty | Add clear description |
| Generic contact email | Incident response delay | Use team email |
| Introspection disabled | Token validation gaps | Enable if needed |
| No logout URL | Session persistence | Configure logout |
Scope Security Guide
Recommended Scopes by Use Case
| Use Case | Recommended Scopes |
|---|---|
| API Integration | Api, RefreshToken |
| User Authentication | OpenID, Profile, Email |
| Full API + Identity | Api, RefreshToken, OpenID, Profile |
| Chatter Integration | Api, ChatterApi |
| Server-to-Server | Api only |
Scopes to Avoid
| Scope | Risk | Alternative |
|---|---|---|
Full |
Complete access to everything | Use specific scopes |
Web + Api together |
Redundant, increases attack surface | Choose one |
RefreshToken for JWT |
Unnecessary, JWT generates new tokens | Remove scope |
IP Restriction Policies
Policy Options
| Policy | Description | Use Case |
|---|---|---|
ENFORCE |
Strict IP enforcement | Production server-to-server |
BYPASS |
No IP restrictions | Development only |
ENFORCE_ACTIVATED_USERS |
Enforce for active users | Mixed environments |
Recommended Configuration
<!-- Production: Server-to-Server -->
<oauthPolicy>
<ipRelaxation>ENFORCE</ipRelaxation>
</oauthPolicy>
<!-- Production: User-Facing -->
<oauthPolicy>
<ipRelaxation>ENFORCE_ACTIVATED_USERS</ipRelaxation>
</oauthPolicy>
<!-- Development Only -->
<oauthPolicy>
<ipRelaxation>BYPASS</ipRelaxation>
</oauthPolicy>
Certificate Management (JWT Bearer)
Certificate Requirements
- RSA 2048-bit or higher key size
- Valid not-before and not-after dates
- Uploaded to Salesforce Certificate and Key Management
- Private key stored securely (HSM, Vault, secure storage)
Certificate Rotation
- Generate new certificate before expiration
- Upload new certificate to Salesforce
- Update Connected App to use new certificate
- Update external system with new private key
- Test authentication
- Remove old certificate after transition period
Monitoring & Audit
What to Monitor
- Login History for Connected App users
- OAuth Usage in Setup
- Event Monitoring for token events (Shield required)
- API Usage limits and patterns
Audit Checklist
- Review Connected Apps quarterly
- Remove unused applications
- Rotate credentials annually
- Verify scope appropriateness
- Check for policy violations
Incident Response
If Credentials Are Compromised
- Immediately rotate Consumer Secret
- Revoke all active tokens
- Review login and access logs
- Update external systems with new credentials
- Investigate scope of compromise
- Document and report incident
Commands for Response
# List all Connected Apps
sf org list metadata --metadata-type ConnectedApp --target-org <org>
# Retrieve for review
sf project retrieve start --metadata ConnectedApp:<AppName> --target-org <org>
Compliance Considerations
GDPR/Privacy
- Ensure data access matches user consent
- Document data flows through Connected Apps
- Implement data retention policies
SOC 2
- Enable audit logging
- Implement access reviews
- Document security controls
- Use certificate-based authentication
HIPAA
- Enable High Assurance sessions
- Restrict data access scopes
- Implement IP restrictions
- Use encrypted connections only