RemoteAction not respecting sharing settings

Question

I have a RemoteAction in my code that queries data. I receive all the records irrespective of the fact that with sharing has been used for the containing class.

Does RemoteAction NOT respect sharing settings?

I read the documentations here and here. and my Controller version is 36.0. but still not pretty sure.

Answer 1

I was only able to reproduce the behavior you describe by changing the controller to without sharing. Regardless, this workaround should let you filter out records which should not be viewable:

@RemoteAction
public static List<MyObject__c> getRecords()
{
    Map<Id, MyObject__c> records = new Map<Id, MyObject__c>([
        SELECT Name FROM MyObject__c
    ]);

    List<MyObject__c> viewable = new List<MyObject__c>();
    for (UserRecordAccess access : [
        SELECT RecordId FROM UserRecordAccess
        WHERE UserId = :UserInfo.getUserId()
        AND HasReadAccess = true
        AND RecordId IN :records.keySet()
    ]) viewable.add(records.get(access.RecordId));
    return viewable;
}