I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best practices for doing the same?

public with sharing class MyController {
    MyCustomObj__c obj; 
    String[] queryFields = new String[] {'Id', 'FirstName__C', 'LastName__c'};
        //What is the best practice for query FLS/CRUD enforcement
        DescribeSObjectResult describeObject = objType.getDescribe();
        Map<String, Schema.SObjectField> objectFields = describeObject.fields.getMap();
        String namespace = 'curr_ns'; //temporary

        for (String field : fields) {
            if (!(objectFields.get(namespace + field).getDescribe().isCreateable() &&
                throw CRUDException();

        this.obj = [SELECT Id, FirstName__C, LastName__c from MyCustomObj__c
                   where Id:someId];

   public void save(){
    //Is this enough? Or Should there be checks for each field being inserted?
        throw CRUDException('');
    insert obj;

   public void delete(){
        throw CRUDException('');
    delete obj;

   public void upsert(){
    if(!(myCustomObj.getSobjectType().getDescribe.isUpdateable() &&
        throw CRUDException('');
    upsert obj;


Couple of questions with the above approach:

  1. Do we have to enforce FLS for all queries in the controller?
  2. What is the best practice for enforcing FLS in queries? Currently I have to maintain a list of strings with fieldNames. When looking up the object map I need to append the namespace as well. Whenever I have to add a field to the query I need to update 2 places. Is there a cleaner approach?
  3. For inserts/updates, do we need to check whether all the fields being inserted our createable/updateable?
  4. There are some open source light weight DML managers - DML Manager Is it advisable to use these? One of the limitations of the said DML Manager is that it performs 2 queries for every DML operation which is not preferred.

1 Answer 1


If you use apex:inputField in the Visualforce, the Field Level Security (FLS) will be handled for you i.e. either an editable field, a non-editable field or no field at all will be rendered.

At the object level, yes use describe calls to check the rights. But rather than throw exceptions, I suggest you do things like hide the "Save" button if the object isn't editable and just display an ApexPages.Message in a blank page if the object isn't readable.

  • I understand. But do we also need to check FLS in the controller for the queries or just before the inserts/deletes/updates. I read that the security reviews would not go through if you do not perform these checks. I have read conflicting information about this on the forum
    – gerad26
    Jan 17, 2017 at 21:11
  • @gerad26 It is possible to write pages where FLS checks are needed in the controller e.g. where the UI isn't created using apex:inputField. Suggest you post a new question that links to the conflicting views so a more knowledgeable person can review and pick out the deciding factors or make a more absolute statement.
    – Keith C
    Jan 18, 2017 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .