REST Service to Expose Attachments as Public CURL

-

My use case behind this blog post is to expose Salesforce Attachment (Image/Pdf/Video) as a public accessible CURL, without having to authenticate to Salesforce. And we are going to use REST Web-services and Public Sites to do this!

Step 1: Create an Apex REST class with below code snippet. 

/*
* Purpose : Apex rest webservice to return attachment body for a given id
* 
* Developer: SFDC_Dev
* 
*/

@RestResource(urlMapping='/Document_V1/*')
global class DocumentV1 {
    @HttpGet
    global static void docBody() {        
        RestRequest request = RestContext.request;
        RestResponse res = RestContext.response;
        try {
            // Retrieve attachment id from the request url
            String docId = request.requestURI.substring(request.requestURI.lastIndexOf('/')+1);
            // Query attachment sObject to get the specific attachment using attachment id        
            Attachment a = [Select Id, Name, Body From Attachment Where Id=:docId]; 
            // Assing proper image extension base on file type
            if (a.Name.containsIgnoreCase('.jpeg') || a.Name.containsIgnoreCase('.jpg'))
                res.addHeader('Content-Type','image/jpg');
            if (a.Name.containsIgnoreCase('.png'))
                res.addHeader('Content-Type','image/png');
            if (a.Name.containsIgnoreCase('.gif'))
                res.addHeader('Content-Type','image/gif');
            if (a.Name.containsIgnoreCase('.pdf'))
                res.addHeader('Content-Type', 'application/pdf');
            if (a.Name.containsIgnoreCase('.mp4'))
                res.addHeader('Content-Type', 'video/mp4');
            // Assign attachment body to the response body
            res.responseBody = a.Body;            
        } catch(exception e) {
            res.responseBody = Blob.valueOf(e.getMessage()); 
        }
    }
}

Step 2: Create Public Site with below settings and also make sure to enable access for the above class on this specific Site Profile using "Public Access Settings".

Now go ahead and attach few attachments like image/pdf/gif on Account object and have those attachment id's handy for testing. Below I am going to test with those Id's using Workbench/CURL and also from the browser to see the responses!

Results from Workbench Testing:


Results from CURL Testing:



Now when I use above Curl's to open them in any browser, It should let me view the actual Attachment!

Sample Gif in a browser:



Sample Pdf in a browser:


Few Pros and Cons to consider before implement above:
  • As we are using Public Sites to expose the Attachments, so there is always a security issue tied to this. However we are returning attachment using its Id, but its always a best practice to white list all the IP address (From which the request may come) by adding them to 'Login IP Ranges' for the Public Site Profile. By doing this no one can access the url from outside those IP's.
  • With Public Site's there is a Daily Limit for the usage and this varies based on License Type, so keep an eye on those limits.
  • Attachments comes under File storage part of the storage limits which should not be an issue on data storage limits, but its always a best practice to purge all unwanted attachments.
  • Notes and Attachments do not support in Lightning and all the Attachments go under "Files", however legacy attachments can still be viewed in Lightning so please be aware of this. We will have to use "ContentVersion" sObject to implement similar functionality for Lightning.


    • Thank you

    Comments

    Post a Comment

    Popular posts from this blog

    Lightning Data Service - Salesforce new Apex alternative - Part 2

    -
    Image
    We have looked on some basic code for Loading and Updating a record using Lightning Design System in my last blog post. Here we are going to work on creating and deleting a record in Lightning Component using Lightning Design System. 1. Creating a Record: For creating a new record using LDS we declare force:recordData without assigning a recordId unlike what we use to do with Load and Update record. And then we load a record template by calling the getNewRecord function on force:recordData and finally we handle saving data using saveRecord in our 'handleSaveRecord' function. Lightning Components Developer guide already have some basic code on creating a Contact record ( Reference Link ). We are going to extend that code a bit to first create a new Account record and then create a new Contact record by linking it to the Account that we created all in one single shot. Below we are going to create a new Lighting Component from Developer Console by navigating to File...
    Read more

    Using JavaScript Promises in Lightning Components

    -
    Image
    With JavaScript being a single threaded process by nature, using "JavaScript Promises" it makes JavaScript to be a multithreaded or in other words it is a process of making Asynchronous calls using JavaScript. JavaScript Promises is a native JavaScript functionality that can be used in Lightning Components. Salesforce recommends using ECMAScript 6 (ES6, often referred to as “Harmony”) which is a standard script language. In case if the browser doesn’t provide a native version, the framework uses a polyfill so that promises work in all browsers supported for Lightning Experience. Basic Syntax for Promises: var promise = return new Promise(function(resolve, reject) { setTimeout(resolve, 100 , 'foo' ); }); Promise can return either resolve (If the result is success) and reject (If the result is fail). Optionally there is one more status called pending. Now let's go ahead and build a simple Lightning Component that will output some user information like...
    Read more

    Two-factor authentication using LWC

    -
    Use Case: In this blog we are going take the use case to build "Two-factor authentication (EMAIL)" using Lightning Web Component. This use case is going to be helpful to place an extra layer of security, especially when when we try to expose Salesforce sensitive data using Public Sites (or) Communities. Code Components: Below we are going to use 3 main code components to implement Two-factor email authentication. 1. CommonUtility.cls : Apex class that has two methods. One method to generate unique 6 digit code using crypto class and another method to generate single email message and dispatch email. public with sharing class CommonUtility { @AuraEnabled(cacheable= true ) // Method to send 6 digit two-factor email verification public static String twoFactorGen(String usrEmail) { String verCode = genUniqueCode(); // generate unique 6 digit code Messaging.SingleEmailMessage message = new Messaging.SingleEmailMessage(); // ins...
    Read more