3

Does Salesforce REST API (not the Apex Rest API) inherently respect field level permissions while fetching data ? Tried to find this in the SF documentation but no luck. Any help is highly appriciated

2 Answers 2

3

Invoking a custom Apex REST Web service method always uses system context. Consequently, the current user's credentials are not used, and any user who has access to these methods can use their full power, regardless of permissions, field-level security, or sharing rules. Developers who expose methods using the Apex REST annotations should therefore take care that they are not inadvertently exposing any sensitive data.

Apex class methods that are exposed through the Apex REST API don't enforce object permissions and field-level security by default. We recommend that you make use of the appropriate object or field describe result methods to check the current user’s access level on the objects and fields that the Apex REST API method is accessing. See DescribeSObjectResult Class and DescribeFieldResult Class.

Also, sharing rules (record-level access) are enforced only when declaring a class with the with sharing keyword. This requirement applies to all Apex classes, including to classes that are exposed through Apex REST API. To enforce sharing rules for Apex REST API methods, declare the class that contains these methods with the with sharing keyword. See Using the with sharing or without sharing Keywords.

Reference from developer.salesforce.com

5
  • Thanks for the answer @RCS. This applies for REST API's implemented in Apex, but I want to know what is the case with Salesforce REST API (not the Apex Rest API).
    – Gopal Rao
    Dec 21, 2016 at 11:25
  • 1
    @GopalRao - Same rules apply
    – Eric
    Dec 21, 2016 at 14:13
  • 2
    You can go with ESAPI to implement FLS and sharing in your webservice. github.com/forcedotcom/force-dot-com-esapi Dec 21, 2016 at 14:19
  • I tried this out, the same does not apply to Salesforce rest API's
    – Gopal Rao
    Dec 22, 2016 at 13:32
  • That is because they implemented what is outlined in the doc. It is doing exactly what the doc says. "We recommend that you make use of the appropriate object or field describe result methods to check the current user’s access level on the objects and fields that the Apex REST API method is accessing."
    – Eric
    Dec 22, 2016 at 14:55
1

I tried this in my dev org, the Salesforce default rest api honors both sharing and field level permissions of the user(whose sessionId/access_token we are using) while fetching data.

5
  • That is because they implemented what is outlined in the doc. It is doing exactly what the doc says. "We recommend that you make use of the appropriate object or field describe result methods to check the current user’s access level on the objects and fields that the Apex REST API method is accessing."
    – Eric
    Dec 22, 2016 at 14:55
  • Yeah exactly. Its recommend but not compulsory in in case of Apex Rest api's, where as in Saleforce rest api's, we don't have that option the feild level permissions are by default honoured
    – Gopal Rao
    Dec 22, 2016 at 15:14
  • Your putting the cart before the horse. SF Rest API's are just like the ones you write. They implemented FLS. If you write an API you should implement FLS. They operate the same.
    – Eric
    Dec 22, 2016 at 15:16
  • I understood your point. But what I wanted to imply is, we still have an option of not enforcing FLS in case of apex apis if we wish so, as they are in our control(though this is not a recommended practice). But same is not tpossible with SF apis
    – Gopal Rao
    Dec 22, 2016 at 15:25
  • True, when looking at it from the user of the API though its all the same. If you in your REST api do not enforce it the user of the API has no control. Its all how the API is designed
    – Eric
    Dec 22, 2016 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .