Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Security changes to the default CLI Connected App (`PlatformCLI`)

Abierto
  • ¿Algo no está bien?
#3,668 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
1/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
1/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript
Área
cli

Línea de trabajo

This issue describes upcoming OAuth policy changes for the default PlatformCLI Connected App and gives no files, tests, or code entry points to change. Start by reading the linked PKCE and jsforce references; done means users understand which login flows are affected, when each change takes effect, and what action to take.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

announcement

We're enabling two OAuth security controls on PlatformCLI, the Connected App the CLI uses by default when you run sf org login web without your own --client-id. They roll out on two dates:

  • PKCE required for web login — enabled October 21, 2026.
  • 30-day refresh-token idle timeout — enabled November 9, 2026.

Most people on a current CLI will notice nothing. Here's what's changing and who might be affected.

1. PKCE is now required for web login (October 21, 2026)

PKCE is a standard that binds an authorization request to the client that started it, so an intercepted auth code can't be redeemed by anyone else. The Salesforce CLI has sent a PKCE challenge on sf org login web for years. This change makes the server reject any web-login request that arrives without one.

Who might be affected:

  • Very old CLI versions. Releases from roughly late 2021 through March 2024 shipped a version of our auth library that did not send a PKCE challenge. Running sf org login web (or sfdx force:auth:web:login) on one of those builds against the default Connected App will now fail at the login step with invalid_request / missing code challenge error.
    • Fix: Update to a current CLI.
  • Custom integrations that authenticate against this Connected App without going through the Salesforce CLI or @salesforce/core. If you built your own web/authorization-code flow (for example, a tool that drives OAuth directly) against the default Connected App, it must now send a code_challenge.
    • Fix: If you use jsforce directly, construct OAuth2 with useVerifier: true. jsforce then generates a PKCE verifier and adds the code_challenge to the authorization request (and code_verifier to the token exchange) for you.
  • Note: This only affects the interactive web login flow. JWT, access-token, and sfdx-url logins do not use PKCE and are unaffected.
  • Note: If you use your own Connected App via --client-id, this setting does not apply to you. Your Connected App's own configuration governs.
2. Refresh tokens will expire after 30 days of inactivity (starting November 9, 2026)

Starting November 9, 2026, the default Connected App has an idle timeout of 30 days on refresh tokens. If a refresh token is not used to get a new access token for 30 consecutive days, it is invalidated server-side and you'll be asked to log in again. Because the change applies going forward, the earliest an idle token can expire is early December 2026.

Who might be affected:

  • This affects login flows that hold a refresh token, namely web and sfdx-url. JWT logins (common in CI) re-sign on every call and are not affected.
  • In practice, any CLI used at least once a month keeps its refresh token alive, so active users should rarely see this. You'd notice it only on an org you haven't touched in over a month, where the fix is simply to run sf org login web again.
  • Note: The 30-day idle clock resets only when the access token expires and your refresh token is used to acquire a new access token from the server.
Questions or concerns?

Please comment on this Issue. We're happy to help you find the right path forward.

Lenguaje dominante
Sin datos de lenguaje
Estrellas
571
Forks
80
Merge medio
14 h 43 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de forcedotcom/cli

Todos los issues de forcedotcom/cli

Issues similares

Más issues de CLI

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.