Metadata

ID: apex-security/hardcoded-salesforce-url

Language: Apex

Severity: Notice

Category: Security

CWE: 547

Description

Using absolute URLs to reference Salesforce pages introduces fragility, as sandbox and production environments are assigned different instance names. Code written with absolute URLs will only function within the corresponding Salesforce instance and will fail once deployed elsewhere. To ensure portability and reliability, always use relative URLs—omitting both domain and subdomain—when linking to Salesforce pages.

Non-Compliant Code Examples

public class AccountHelper {
    
    // A method inside the class
    public List<Account> getActiveAccounts(Integer limitSize) {
        String foo = 'https://subdomain.salesforce.com/something';
    }
}

Compliant Code Examples

public class AccountHelper {
    
    // A method inside the class
    public List<Account> getActiveAccounts(Integer limitSize) {
        String foo = URL.getSalesforceBaseUrl().toExternalForm() + '/something';
    }
}