Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Security changes to the default CLI Connected App (`PlatformCLI`)

Đang mở
  • Có gì không ổn?
#3,668 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
1/5
Thời gian dự kiến
Dưới một giờ
Mức phù hợp với người mới
1/100
Loại issue
Tài liệu
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
javascript
Lĩnh vực
cli

Hướng nghiên cứu

This issue describes upcoming OAuth policy changes for the default PlatformCLI Connected App and gives no files, tests, or code entry points to change. Start by reading the linked PKCE and jsforce references; done means users understand which login flows are affected, when each change takes effect, and what action to take.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

announcement

We're enabling two OAuth security controls on PlatformCLI, the Connected App the CLI uses by default when you run sf org login web without your own --client-id. They roll out on two dates:

  • PKCE required for web login — enabled October 21, 2026.
  • 30-day refresh-token idle timeout — enabled November 9, 2026.

Most people on a current CLI will notice nothing. Here's what's changing and who might be affected.

1. PKCE is now required for web login (October 21, 2026)

PKCE is a standard that binds an authorization request to the client that started it, so an intercepted auth code can't be redeemed by anyone else. The Salesforce CLI has sent a PKCE challenge on sf org login web for years. This change makes the server reject any web-login request that arrives without one.

Who might be affected:

  • Very old CLI versions. Releases from roughly late 2021 through March 2024 shipped a version of our auth library that did not send a PKCE challenge. Running sf org login web (or sfdx force:auth:web:login) on one of those builds against the default Connected App will now fail at the login step with invalid_request / missing code challenge error.
    • Fix: Update to a current CLI.
  • Custom integrations that authenticate against this Connected App without going through the Salesforce CLI or @salesforce/core. If you built your own web/authorization-code flow (for example, a tool that drives OAuth directly) against the default Connected App, it must now send a code_challenge.
    • Fix: If you use jsforce directly, construct OAuth2 with useVerifier: true. jsforce then generates a PKCE verifier and adds the code_challenge to the authorization request (and code_verifier to the token exchange) for you.
  • Note: This only affects the interactive web login flow. JWT, access-token, and sfdx-url logins do not use PKCE and are unaffected.
  • Note: If you use your own Connected App via --client-id, this setting does not apply to you. Your Connected App's own configuration governs.
2. Refresh tokens will expire after 30 days of inactivity (starting November 9, 2026)

Starting November 9, 2026, the default Connected App has an idle timeout of 30 days on refresh tokens. If a refresh token is not used to get a new access token for 30 consecutive days, it is invalidated server-side and you'll be asked to log in again. Because the change applies going forward, the earliest an idle token can expire is early December 2026.

Who might be affected:

  • This affects login flows that hold a refresh token, namely web and sfdx-url. JWT logins (common in CI) re-sign on every call and are not affected.
  • In practice, any CLI used at least once a month keeps its refresh token alive, so active users should rarely see this. You'd notice it only on an org you haven't touched in over a month, where the fix is simply to run sf org login web again.
  • Note: The 30-day idle clock resets only when the access token expires and your refresh token is used to acquire a new access token from the server.
Questions or concerns?

Please comment on this Issue. We're happy to help you find the right path forward.

Ngôn ngữ chính
Không có dữ liệu ngôn ngữ
Star
571
Fork
80
Merge trung bình
14 giờ 43 phút
Pull request đã merge (30 ngày)
5

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của forcedotcom/cli

Tất cả issue của forcedotcom/cli

Issue tương tự

Thêm issue về CLI

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.