2

For simple component work, I prefer to use Lightning Data Service as opposed to @AuraEnabled Apex.

And while I have not seen this documented, it appears that the Lightning Data Service always respects running user's object/field access.

In most cases this is great. In other cases I wish I could toggle this behavior ala "with sharing" keyword in Apex.

Has anyone seen formal documentation that confirms the Lightning Data Service always respects user's object/field access levels and cannot be toggled? Is there a way around this?

Improve this question

2 Answers 2

Reset to default
3

The developer docs do indeed say that FLS/sharing is respected by Data Service:

Use Lightning Data Service to load, create, edit, or delete a record in your component without requiring Apex code. Lightning Data Service handles sharing rules and field-level security for you. In addition to not needing Apex, Lightning Data Service improves performance and user interface consistency.

https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/data_service.htm

I don't believe that you can make it ignore FLS/Sharing. So you would have to write your own Apex controller for that. Or, even better, roll your own custom component which encapsulates data access and works like Data Service, just without the security part.

Improve this answer
3
  • thank you for providing the link for other readers. I did see that, but as it is written I did not take "...Lightning Data Service handles sharing rules and field-level security for you..." to mean "Lightning Data Service must always respect the running user's object/field access". However, I do understand the inference you are drawing and I think its a valid one to make. Seems like there is no way around this, no "toggle"... Lightning Data Service just works this way by design.
    – krigi
    Commented Jan 23, 2018 at 19:23
  • 2
    I can confirm that Lightning Data Service always applies sharing and field level security. There is intentionally no way around this because it'd create a security issue. If you need to access metadata or data without user-level security applied you must do so in Apex because it runs in system mode. Refer to Apex documentation for the various security modes/contexts (eg with vs without sharing).
    – Kevin Venkiteswaran
    Commented Jan 24, 2018 at 5:28
  • Thank you @Kevin Venkiteswaran for confirming. I would like to see the Lightning Data Service docs updated to better reflect your comments. Perhaps "Lightning Data Service handles sharing rules and field-level security for you" becomes something like "Lightning Data Service handles sharing rules and field-level security for you, these are always enforced".
    – krigi
    Commented Jan 31, 2018 at 20:04
0

Nothing official that I've seen, but Visualforce Remote Objects did enforce FLS, and given that was a service to get data from the backend straight into JavaScript I'd be surprised if this was very different. One thing you may need to be wary of (I've not tested this) is objects with high record counts. Visualforce Remote Objects were not performant when querying contacts from a table of 30,000 rows.

WRT: "object/field access levels" - note that without sharing/with sharing only affects sharing rules, it does not impact FLS or object permissions. These are not enforced by Apex and it's up to you to do it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .