Considerations for Security

To use outbound messaging, ensure that no third party can send messages to the endpoint while pretending to be from Salesforce:

• Lock down the client application’s listener to accept requests only from Salesforce IP ranges. While this action guarantees that the message came from Salesforce, it does not guarantee that another customer is not pointing to your endpoint and sending messages. For an up-to-date list of Salesforce IP ranges, see What are the Salesforce IP Addresses to whitelist?
• Use SSL/TLS. Using SSL/TLS provides confidentiality while data is transported across the internet. Without it, a malicious third party can eavesdrop on your data. This issue is especially important if you pass data with privacy requirements and you pass a SessionId with the message. Also, we authenticate the certificate presented on connection, ensure that it is from a valid Certificate Authority, and check that the domain in the certificate matches the one Salesforce is trying to connect. This prevents us from communicating with the wrong endpoint.
• If the configuration of your application (endpoint) server's SSL/TLS allows, validate the identity of the Salesforce server when it takes the role of a client to your server, using the Salesforce client certificate. For instructions to download the certificate, see Downloading the Salesforce Client Certificate.
• The organization Id is included in each message (see ID Field Type for more information about the Id field type). Your client application should validate that messages contain your organization Id.