Vrftjkry

Project

Build a form off salesforce that can be sent to clients to collect information. Sent by email through salesforce as a button available to sales users off the account record

Requirements

• Secure


• Link is time-bombed to 24 hours to prevent re-entry updates


• Updates account record validates information lightly upfront

What I Currently have Accomplished

• Built Visualforce form off sites




• validation rules are written off jQuery

What I could use advice with

• How to create a time bombed link to send to each customer listed on the record




• How to send the form to each client with its information feeding back to the sending record.

Any help is appreciated! I'm looking for a discussion on the topic mostly.
If what I ask is impossible feel free to poke holes.

You could certainly create an expiring token to "time bomb" your page. The following steps should provide an outline:

• Add a field named Form_Token__c Text (32)
  


• Add a Time Based Workflow Rule to clear the value after 24 hours


• 
  

  Update any triggers on your object (or add one if none exist) to set this token value

  
  
  
  
  
  • 
    

    Since I have been looking at how to generate a UUID, the following code springs to mind:

    
    
    

    record.Form_Token__c = EncodingUtil.ConvertTohex(Crypto.GenerateAESKey(128));
    
    

    
    
  
  
  
  


• 
  

  Add this property to your controller:

  
  
  

  public Boolean getHasValidToken()
  
  {
  
      String token = ApexPages.currentPage().getParameters.get('token');
  
      return (token != null && token == record.Form_Token__c);
  
  }
  
  

  
  


• Merge token={!record.Form_Token__c} into your url


• 
  

  Update your markup to key on the hasValidToken value, something like below:

  
  
  

  <apex:page controller="...">
  
      <apex:pageMessage summary="<expiry notice>" rendered="{!NOT(hasValidToken)}" />
  
      <apex:outputPanel layout="none" rendered="{!hasValidToken}"> 
  
          <!-- existing markup -->
  
      </apex:outputPanel>
  
  </apex:page>
  
  

  
  

Another thought...

You could store a secret key in a custom setting or custom metadata. When you generate a link, it will have an expiry timestamp parameter, a customer ID parameter and a hash parameter.

The hash would be generated in Apex by appending the timestamp and the ID into one string, encrypting it with the secret key, generating a MD5 digest, and then converting to hexadecimal.

When the page is visited, Apex would validate the hash by attempting to recalculate it from the secret and the other parameters. If the output matches the hash in the URL, it's legit and they're allowed in.

What's nice about this approach is, the whole request is tamper proof. You can add more parameters and add them to the hash algorithm, and the URL will only be valid for exactly that same combination of parameters it was generated for. Also you don't have to actually store any information about ongoing validity of tokens. You can simply authenticate whether a request was genuine and unexpired on-the-fly.