I want to pass salesforce security review in my app. I want to make sure that all the known issues fixed before submission. I have Enforced CRUD and FLS in to all the apex classes. But i am not sure about the following points:

1) Is it necessary to Enforce CRUD and FLS on VF page using the AJAX Toolkit:

sforce.connection.query("Select Id, Name From Account",callback);

2) Is it necessary to Enforce CRUD and FLS in trigger handler classes:


trigger VAccountTrigger on Account(before update) {

    VAccountTriggerHandler vHandler = new VAccountTriggerHandler();

    if(Trigger.isUpdate && Trigger.isBefore){


public class VAccountTriggerHandler {

    public void beforeUpdate(List<Account> newList) {
    //----Do we need to Enforce CRUD and FLS here too---

2 Answers 2


When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page. For example, if a user without FLS visibility to the Phone field of the Contact object was to view the below page, phone numbers would be automatically removed from the table.

<apex:page standardController="Account"> 
  <apex:pageBlock title="Contacts"> 
    <apex:dataTable value="{!account.Contacts}" var="contact" cellPadding="4" border="1"> 
        <apex:facet name="header">Name</apex:facet> 
        <apex:facet name="header">Phone</apex:facet> 

When we refer fields indirectly then we need to check FLS by our self. For example using wrapper classes or in trigger helper classes.

public with sharing class RandomContactController {
    public String getGetRandomName() {
        // Check if the user has read access on the Contact.Name field
        if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){
          return '';

        Contact [] myList = [SELECT Name FROM Contact LIMIT 1000];
        // Pick a list entry at random
        Integer index = Math.mod(Math.abs(Crypto.getRandomInteger()),myList.size());
        Contact selected = myList.get(index);
        return selected.Name;

For more details refer: https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS


For your VAccountTriggerHandler class, yes, you'll need to enforce CRUD/FLS checks (as well as sanitation and other protective measures) manually for security review purposes.

Consider using WITH SECURITY_ENFORCED in your SOQL for a quick catch-all CRUD/FLS fix, or consider .stripInaccessible(), both of which are going GA soon.

See (and do) the Develop Secure Web Apps trail for all the different security measures to account for.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .