Most optimal way to Enforce CRUD/FLS in Apex

Question

This article shows a common way to check access in Apex with a syntax like:

if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){
    return '';
}

However, it is very time/space-consuming to check every single field you want to access/update manually one at a time, especially when you are working with tens of fields every time.

I know ESAPI automatically does this check and verifies access to fields but I don't see it commonly used in the community. Why?

And what is the fastest/most efficient way to ensure CRUD/FLS security of an app?

Answer 1

You could write a helper method for this type of functionality:

public Object flsGet(SObject record, SObjectField field)
{
    return !field.getDescribe().isAccessible() ? null : record.get(field);
}

With this reusable method, you can now just one-line the check:

Contact someRecord = [SELECT Name FROM Contact LIMIT 1];
system.debug(flsGet(someRecord, Contact.Name));

---

If you're really worried about performance, you could write a caching mechanism. You may do more harm than good though. I certainly haven't profiled it. Your code could be structured something like:

public class FLS
{
    public static Boolean isAccessible(SObjectType sObjectType, SObjectField field)
    {
        return getAccessibleFields(sObjectType).contains(field);
    }

    static Map<SObjectType, Set<SObjectField>> accessible;
    public static Set<SObjectField> getAccessibleFields(SObjectType sObjectType)
    {
        if (accessible == null)
            accessible = new Map<SObjectType, Set<SObjectField>>();
        if (!accessible.containsKey(sObjectType))
            accessible.put(sObjectType, getAccessibleFields(sObjectType));
        return accessible.get(sObjectType);
    }
    static Set<SObjectField> getAccessibleFields(SObjectType sObjectType)
    {
        // implementation should be straightforward
    }
}