5

I know how to controll access to Lightning pages and components using static metadata (permissions, visibility modifiers and so on).

What I am instead looking for is:

An elegant, fast, standard-compliant and reusable way to allow / block access based on the user (and the org) in the moment when the component is accessed.

In Visualforce that is easy: One Page. One Apex Controller. And the controller action could then just either load the page properly or show an error.

1

This is what I came up with on my own:


1) Access Control via Lightning component

<aura:component controller="AccessCtrl">
   <c:checkAccess conditionA="{!c.foo}" .../>
   ...

</aura:component>

<c:checkAccess /> would check the conditions in Apex on component init() and throw an AuraHandledException if the user has no access.

I really liked that solution as it clearly separates access control from the components that use it. No other Apex or Lightning controller is sprinkled with access logic.

But it's fake security because its client side. And client side code can always be hacked. Just open the browser debugger and route the javascript to ignore the response or not even do the callback.

So what next?


2) Check in all @AuraEnabled methods

public class MySecureComponentCtrl {

    @AuraEnabled
    public static void businessLogic(Id accountId, List<Contact> contactsToDelete) {
        verifyUserHasAccess(accountId);

        delete contactsToDelete;
    }

    ...

    private static void verifyUserHasAccess(Id recordId) {
        if(...) {
            throw new AuraHandleException('no access');
        }
    }
}

But even that is not sufficient as I might just pass in a different account id which I have access to and delete totally unrelated contacts.

enter image description here


3) Check not before but while you are doing relevant stuff

public class MySecureComponentCtrl {

    @AuraEnabled
    public static void businessLogic(Id accountId, List<Contact> contactsToDelete) {
        verifyIsAllowedToDelete(accountId, contactsToDelete);

        delete contactsToDelete;
    }

    ...

    private static void verifyIsAllowedToDelete(Id accountId, List<Contact> contactsToDelete) {
        if(...) {
            throw new AuraHandleException('no access');
        }
    }
}
  • To verifyIsAllowedToDelete, why not just use CRUD/ FLS to check for privilegies ? – Bryce Jul 12 at 7:27
  • Because a software might have custom access rules on top of what Salesforce provides. – Robert Sösemann Jul 12 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.