When designing flows, keep these security considerations in mind.
Required Editions
| View supported editions. |
Flow Interviews
When a user session expires, Salesforce interrupts in-progress flow interviews, and users can’t resume them. If the flow ran actions, such as a Create Records or Post to Chatter element, Salesforce doesn’t roll back those actions. But the interview loses other progress, such as what the user entered on the screen.
- Set your session timeout settings to log out users after an appropriate period.
- Encourage your users to pay attention during interviews for alerts about their sessions expiring soon.
- Remind users to avoid running flows during release upgrades. A typical upgrade takes about 5 minutes.
Expired user sessions don’t affect paused or waiting flow interviews.
Shield Platform Encryption
You can’t filter or sort records by encrypted fields for these elements and resources.
- Update Records element
- Delete Records element
- Get Records element
- Record Choice Set resource
Screen Flow Inputs
For enhanced security, remove all HTML from publicly accessible input fields in screen flows. For example, an input field on a publicly accessible screen flow maps to a rich text field in Salesforce. To prevent a malicious URL from accessing the rich text field, create a separate flow on the object to strip out the HTML. Optimize the new flow for fast field updates, and set it to run whenever the input field isn’t blank. Because several sources can write to a publicly accessible input field, check for HTML at the field level and not at the screen level.
You can also use an existing Apex trigger on the object to strip out the HTML.
Custom Metadata Types and Custom Settings
Flows can read public custom metadata types and custom settings regardless of the running user’s permissions, whether the flow runs in user context or system context.
In flows that run on API version 64.0 and later, a screen can show fields from custom metadata type records and custom setting records that a Get Records element retrieves. The screen shows these fields even when the running user doesn’t have access to them. In flows that run on API version 63.0 and earlier, the screen returns an error for those fields when the running user lacks access to them.
