General Security Information

Owned by Karl Tompson
Last updated: May 29, 2023
2 min read

Authentication and Authorization

When using a public site at the service end, Send2CRM employs various mechanisms to reduce spam submissions and avoid consuming excessive resources where unnecessary. However, it is ultimately a publicly-accessible service (as with any website form) that uses server-side configuration to define which data may be submitted and where it will be stored. The service only exposes a very limited subset of functionality, full API access is not available via the JavaScript client.

Access to the forms endpoint is always public. Never consider a form mapping to have restricted access.

Visitor behavior and related data are updated via an endpoint that has strict limitations to its capabilities and only accepts data that meets a pre-defined structure:

  • Only pre-existing visitors may send updates.

  • Visitors and sessions without required control properties are ignored.

  • Unrecognized visitor and session properties are ignored.

  • Only the custom visitor, session and related objects provided by the Send2CRM package are updated.

Cross-Site Scripting (XSS)

Send2CRM takes information primarily from form submissions. It also takes a small amount of data from DOM elements and URL parameters. This data may be encoded and sent to Salesforce as JSON.

Send2CRM does not output content into the website DOM.

XSS vulnerabilities in other parts of the website could allow an attacker to access the contents of browser local storage, which is where Send2CRM keeps local data. This may expose personal information about visitors. Send2CRM does not keep credentials of any kind in local storage.

Data Validation and Sanitization

Server-side sanitization and data type checking is performed on all data sent by the Send2CRM client.

  • Where field permissions are not available, mapped fields are ignored. Note this may cause overall form submission failure where these fields are required.

  • Standard validation is available via form conditions in the Salesforce package. Invalid data will automatically result in submission failure.

  • Custom form validation is also available for advanced use.

  • Personalization data is returned to the client only for mapped fields. Note that Salesforce encrypted fields are an exception, these are never returned.

Connection Protocol

Send2CRM requires the use of HTTPS. It also requires CORS header implementation.

Third-party Libraries

The Send2CRM client is bundled with several small MIT-licensed open-source JavaScript dependencies. These are regularly audited for vulnerabilities and updated or patched where necessary.

Debugging and Logging

Both client-side and service-side logging is available for troubleshooting purposes. Avoid exposing this information to end users.

Note that the Send2CRM client script is supplied in minified form only.