sfcc-security

Apply secure coding practices to Salesforce B2C Commerce Cloud development.

27|9|Updated Aug 8, 2025

Search Tags:#authorization #security #authentication #cryptography #csrf #secrets-management #sfcc

Ready to run

npx skills add https://github.com/taurgis/sfcc-dev-mcp --skill sfcc-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sfcc-security
Source: https://github.com/taurgis/sfcc-dev-mcp/tree/main/ai-instructions/skills/sfcc-security
Command: npx skills add https://github.com/taurgis/sfcc-dev-mcp --skill sfcc-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Salesforce B2C Commerce Cloud developers often struggle to implement and enforce secure coding practices across SFRA controllers, OCAPI/SCAPI hooks, and custom SCAPI endpoints. This Skill consolidates guidance to reduce security risks and help teams apply consistent security patterns.

Core Features & Use Cases

CSRF protection integration guidelines for storefront controllers.
Authentication and authorization best practices for both user and admin contexts.
Secure cryptography usage and secrets management with Salesforce dw.crypto and secure storage recommendations.
Secure coding patterns applicable to Controllers, Hooks, and Custom Endpoints across SFCC projects.
Use Case: A development team hardening an existing SFRA storefront and its custom endpoints.

Quick Start

Review and apply these security best practices to harden SFCC code in current projects.

Frequently Asked Questions about sfcc-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add CSRF protection to Salesforce B2C Commerce Cloud SFRA controllers?▼

To add CSRF protection in Salesforce B2C Commerce Cloud, apply secure coding patterns within SFRA controllers to verify incoming requests. This ensures OWASP compliance and prevents unauthorized actions.

What are the authentication and authorization best practices for SFCC custom SCAPI endpoints?▼

Authentication and authorization best practices for SFCC custom SCAPI endpoints involve enforcing strict access controls for both user and admin contexts. Developers must apply proper server-side validation to ensure only authenticated sessions reach secured resources.

How do I manage secrets and use cryptography securely in SFCC development?▼

Secure cryptography and secrets management in SFCC development requires utilizing the Salesforce dw.crypto API while storing sensitive keys in secure storage. Developers must avoid hardcoded secrets and deprecated cryptographic primitives to maintain application integrity.

Does this security guidance apply to OCAPI hooks and SCAPI hooks?▼

Yes, this security guidance applies directly to OCAPI and SCAPI hooks. It provides secure coding patterns for these integration points, ensuring proper server-side validation and secure authentication practices are enforced across real-world storefront scenarios.

What are common security limitations to avoid when hardening SFRA storefronts?▼

Common security limitations when hardening SFRA storefronts include using deprecated cryptographic primitives and hardcoding secrets directly in code. Avoiding these practices ensures compliance with OWASP standards and maintains proper server-side validation.