4

I would like to understand the difference between protected and public visibility on custom settings.

I know a managed package custom setting is protected and cannot be accessed everywhere from the https://help.salesforce.com/HTViewHelpDoc?id=cs_define.htm&language=en_US, but I'm trying to understand any use case for that.

What happens if I create a custom settings and use protected vs private? Does it allow me to restrict access for users based on visibility or restricts accessing from apex or formulas?

Improve this question

1 Answer 1

Reset to default
11

There's no difference between public and protected custom settings in an unmanaged package scenario. Anyone with Customize Application can modify the values of the custom settings.

For a managed package, protected completely hides the values from the subscriber. This includes Apex Code, validation rules, workflow rules, flows, Visualforce pages, triggers, custom buttons and links, and any other place you might be able to access custom settings normally.

The usual case for using protected custom settings is to provide a data store that administrators cannot modify. Passwords, encryption keys, license settings, and other things that you simply do not want to allow administrators to modify should be placed in protected custom settings. This includes settings that can be "messed up" if not modified in a controlled manner.

Public custom settings allow administrators to view and modify values, as well as allow them to create code that can manipulate those values. Use public custom settings for things like "user preferences" or other non-sensitive data that isn't vital to your application's operation.

Improve this answer
5
  • Thank you @sfdcfox, understood the difference with great explanation.
    – Anurag
    Jul 7, 2016 at 16:10
  • @sfdcfox Does that mean the users will not have access to this custom setting through the managed apex code as well?
    – Vignesh Damodharan
    Aug 10, 2016 at 7:12
  • 1
    @Vignesh no, managed code can access the settings. The purpose is to provide controlled access to the settings.
    – sfdcfox
    Aug 10, 2016 at 7:14
  • @sfdcfox, one more quick question. Does the custom settings need the FLS CRUD check suggested by checkmarx? Or can we mark it false positive?
    – Vignesh Damodharan
    Aug 10, 2016 at 7:33
  • @Vignesh it is most definitely a false positive. You can do whatever you want with your own data.
    – sfdcfox
    Aug 10, 2016 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .