Establishing a Trusted Connection Between Private Spaces and Salesforce
Last updated 13 September 2017
When using Heroku and Salesforce together, security posture may be improved with an exclusive trust relationship, preventing undesired traffic from the public internet. Using IP restrictions, exclusive trust may be established between Heroku Private Spaces and Salesforce. The two directions of traffic may be configured independently.
Requirements:
Salesforce → Heroku apps
Frequently, apps running on Heroku should be accessible only to Salesforce. A popular use-case is a Heroku app providing HTTP/REST query interfaces to custom Apex or Lightning components. If an API is not intended for public consumption, then best to block public access.
Allow incoming Salesforce traffic
Set all Salesforce IP ranges as Trusted IP ranges for the Private Space. Reference the Salesforce IP Addresses & Domains knowledge article for a list of all CIDR blocks to trust.
Prevent public traffic
Remember to remove the default entry 0.0.0.0/0 from the Trusted IP ranges for the Private Space. This will block all traffic from the public internet that is not explicitly allowed.
Heroku apps → Salesforce
By default, Salesforce allows login from anywhere on the public internet. Risk of malicious login activity can be minimized through IP address restrictions.
Limit direct user login
Setup Salesforce Login IP restrictions for the integration user.
Limit connected app (OAuth) access
Configure an IP Range for a connected app, to block public access to a connected app’s OAuth provider.
Combine with other techniques
IP restrictions are just one security tool, not a magic bullet. Layering more security strategies together will further decrease risks: SSL/TLS certificates, request authentication, and proactive penetration testing are all crucial to developing a trustworthy app.