skills.rest
taurgis
taurgisCOMMUNITY
Explore all skills by this author →
Website𝕏@theunenthGitHub

sfcc-security

Apply secure coding practices to Salesforce B2C Commerce Cloud development.

27|9|Updated Aug 8, 2025
Search Tags:#authorization#security#authentication#cryptography#csrf#secrets-management#sfcc
One-click install
npx skills add https://github.com/taurgis/sfcc-dev-mcp --skill sfcc-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sfcc-security
Source: https://github.com/taurgis/sfcc-dev-mcp/tree/main/ai-instructions/skills/sfcc-security
Command: npx skills add https://github.com/taurgis/sfcc-dev-mcp --skill sfcc-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Salesforce B2C Commerce Cloud developers often struggle to implement and enforce secure coding practices across SFRA controllers, OCAPI/SCAPI hooks, and custom SCAPI endpoints. This Skill consolidates guidance to reduce security risks and help teams apply consistent security patterns.

Core Features & Use Cases

  • CSRF protection integration guidelines for storefront controllers.
  • Authentication and authorization best practices for both user and admin contexts.
  • Secure cryptography usage and secrets management with Salesforce dw.crypto and secure storage recommendations.
  • Secure coding patterns applicable to Controllers, Hooks, and Custom Endpoints across SFCC projects.
  • Use Case: A development team hardening an existing SFRA storefront and its custom endpoints.

Quick Start

Review and apply these security best practices to harden SFCC code in current projects.

Frequently Asked Questions about sfcc-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add CSRF protection to Salesforce B2C Commerce Cloud SFRA controllers?▼

To add CSRF protection in Salesforce B2C Commerce Cloud, apply secure coding patterns within SFRA controllers to verify incoming requests. This ensures OWASP compliance and prevents unauthorized actions.

What are the authentication and authorization best practices for SFCC custom SCAPI endpoints?▼

Authentication and authorization best practices for SFCC custom SCAPI endpoints involve enforcing strict access controls for both user and admin contexts. Developers must apply proper server-side validation to ensure only authenticated sessions reach secured resources.

How do I manage secrets and use cryptography securely in SFCC development?▼

Secure cryptography and secrets management in SFCC development requires utilizing the Salesforce dw.crypto API while storing sensitive keys in secure storage. Developers must avoid hardcoded secrets and deprecated cryptographic primitives to maintain application integrity.

Does this security guidance apply to OCAPI hooks and SCAPI hooks?▼

Yes, this security guidance applies directly to OCAPI and SCAPI hooks. It provides secure coding patterns for these integration points, ensuring proper server-side validation and secure authentication practices are enforced across real-world storefront scenarios.

What are common security limitations to avoid when hardening SFRA storefronts?▼

Common security limitations when hardening SFRA storefronts include using deprecated cryptographic primitives and hardcoding secrets directly in code. Avoiding these practices ensures compliance with OWASP standards and maintains proper server-side validation.

Related Skills

Explore More Software Engineering Skills→
finsilabsfinsilabs
44

sfcc-cartridge-development

Build custom SFCC cartridges with SFRA controllers, ISML templates, and OCAPI/SCAPI integration.

Official
Advanced
AcczdyAcczdy
2

testing-api-security-with-owasp-top-10

Assess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.

Community
Intermediate
djnsty23djnsty23
2

security

Scan code for hard-coded secrets and validate environment policies before deployment.

Community
Advanced
JesusFigueroa25JesusFigueroa25

Security Engineer

Analyze application security via threat modeling, vulnerability assessment, and secure code review.

Community
Advanced