I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best practices for doing the same?

public with sharing class MyController {
    MyCustomObj__c obj; 
    String[] queryFields = new String[] {'Id', 'FirstName__C', 'LastName__c'};
        //What is the best practice for query FLS/CRUD enforcement
        DescribeSObjectResult describeObject = objType.getDescribe();
        Map<String, Schema.SObjectField> objectFields = describeObject.fields.getMap();
        String namespace = 'curr_ns'; //temporary

        for (String field : fields) {
            if (!(objectFields.get(namespace + field).getDescribe().isCreateable() &&
                throw CRUDException();

        this.obj = [SELECT Id, FirstName__C, LastName__c from MyCustomObj__c
                   where Id:someId];

   public void save(){
    //Is this enough? Or Should there be checks for each field being inserted?
        throw CRUDException('');
    insert obj;

   public void delete(){
        throw CRUDException('');
    delete obj;

   public void upsert(){
    if(!(myCustomObj.getSobjectType().getDescribe.isUpdateable() &&
        throw CRUDException('');
    upsert obj;


Couple of questions with the above approach:

  1. Do we have to enforce FLS for all queries in the controller?
  2. What is the best practice for enforcing FLS in queries? Currently I have to maintain a list of strings with fieldNames. When looking up the object map I need to append the namespace as well. Whenever I have to add a field to the query I need to update 2 places. Is there a cleaner approach?
  3. For inserts/updates, do we need to check whether all the fields being inserted our createable/updateable?
  4. There are some open source light weight DML managers - DML Manager Is it advisable to use these? One of the limitations of the said DML Manager is that it performs 2 queries for every DML operation which is not preferred.

1 Answer 1


If you use apex:inputField in the Visualforce, the Field Level Security (FLS) will be handled for you i.e. either an editable field, a non-editable field or no field at all will be rendered.

At the object level, yes use describe calls to check the rights. But rather than throw exceptions, I suggest you do things like hide the "Save" button if the object isn't editable and just display an ApexPages.Message in a blank page if the object isn't readable.

  • I understand. But do we also need to check FLS in the controller for the queries or just before the inserts/deletes/updates. I read that the security reviews would not go through if you do not perform these checks. I have read conflicting information about this on the forum
    – gerad26
    Jan 17, 2017 at 21:11
  • @gerad26 It is possible to write pages where FLS checks are needed in the controller e.g. where the UI isn't created using apex:inputField. Suggest you post a new question that links to the conflicting views so a more knowledgeable person can review and pick out the deciding factors or make a more absolute statement.
    – Keith C
    Jan 18, 2017 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.