Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Security changes to the default CLI Connected App (`PlatformCLI`)

Ouverte
  • Quelque chose ne va pas ?
#3,668 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
1/5
Temps estimé
Moins d'une heure
Accessibilité débutants
1/100
Type d'issue
Documentation
Clarté
Clairement spécifiée
Activité
Active
Stack technique
javascript
Domaine
cli

Piste de recherche

This issue describes upcoming OAuth policy changes for the default PlatformCLI Connected App and gives no files, tests, or code entry points to change. Start by reading the linked PKCE and jsforce references; done means users understand which login flows are affected, when each change takes effect, and what action to take.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

announcement

We're enabling two OAuth security controls on PlatformCLI, the Connected App the CLI uses by default when you run sf org login web without your own --client-id. They roll out on two dates:

  • PKCE required for web login — enabled October 21, 2026.
  • 30-day refresh-token idle timeout — enabled November 9, 2026.

Most people on a current CLI will notice nothing. Here's what's changing and who might be affected.

1. PKCE is now required for web login (October 21, 2026)

PKCE is a standard that binds an authorization request to the client that started it, so an intercepted auth code can't be redeemed by anyone else. The Salesforce CLI has sent a PKCE challenge on sf org login web for years. This change makes the server reject any web-login request that arrives without one.

Who might be affected:

  • Very old CLI versions. Releases from roughly late 2021 through March 2024 shipped a version of our auth library that did not send a PKCE challenge. Running sf org login web (or sfdx force:auth:web:login) on one of those builds against the default Connected App will now fail at the login step with invalid_request / missing code challenge error.
    • Fix: Update to a current CLI.
  • Custom integrations that authenticate against this Connected App without going through the Salesforce CLI or @salesforce/core. If you built your own web/authorization-code flow (for example, a tool that drives OAuth directly) against the default Connected App, it must now send a code_challenge.
    • Fix: If you use jsforce directly, construct OAuth2 with useVerifier: true. jsforce then generates a PKCE verifier and adds the code_challenge to the authorization request (and code_verifier to the token exchange) for you.
  • Note: This only affects the interactive web login flow. JWT, access-token, and sfdx-url logins do not use PKCE and are unaffected.
  • Note: If you use your own Connected App via --client-id, this setting does not apply to you. Your Connected App's own configuration governs.
2. Refresh tokens will expire after 30 days of inactivity (starting November 9, 2026)

Starting November 9, 2026, the default Connected App has an idle timeout of 30 days on refresh tokens. If a refresh token is not used to get a new access token for 30 consecutive days, it is invalidated server-side and you'll be asked to log in again. Because the change applies going forward, the earliest an idle token can expire is early December 2026.

Who might be affected:

  • This affects login flows that hold a refresh token, namely web and sfdx-url. JWT logins (common in CI) re-sign on every call and are not affected.
  • In practice, any CLI used at least once a month keeps its refresh token alive, so active users should rarely see this. You'd notice it only on an org you haven't touched in over a month, where the fix is simply to run sf org login web again.
  • Note: The 30-day idle clock resets only when the access token expires and your refresh token is used to acquire a new access token from the server.
Questions or concerns?

Please comment on this Issue. We're happy to help you find the right path forward.

Langage dominant
Aucune donnée de langage
Étoiles
571
Forks
80
Merge moyen
14 h 43 min
PR mergées (30 j)
5

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de forcedotcom/cli

Toutes les issues de forcedotcom/cli

Issues similaires

Plus d'issues CLI

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.