Experience Cloud.
All posts.
An Experience Cloud Tile Launch Is a Session Hand-Off, Not a Login
Moving between Experience Cloud sites reuses one session, so a Login Flow on the destination never fires. Here is how to prove it from the login records.
SAME_ORG_SSO: Why One Experience Cloud Site Cannot Be an Identity Provider for Another
Salesforce blocks OIDC between two Experience Cloud sites in one org. Why a site is not an identity authority, and why SAML is the one route still open.
Building a Terms Acceptance Gate in Experience Cloud That Actually Fires
A Login Flow cannot gate an Experience Cloud site reached from another. Here is the component and Apex pattern that does, using the standard Consent objects.
Salesforce Lets You Allowlist Chrome Extensions on Experience Cloud Sites
Winter '27 lets you allowlist specific Chrome extensions as trusted URLs on an Experience Cloud site. What it controls, and the two limits that matter.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.