I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check it in code or can i skip it?

1 Answer 1


If you're using a Visualforce page and a standard controller, SFDC automatically checks this for you. In case you're writing custom controllers, you'll have to manually run the CRUD/FLS checks. These are enforced at the visualforce layer, not apex. This is a good blog post that contains some examples as well as a bit of an explanation on how it works and how it can be implemented.

Keep in mind though that FLS for any apex:inputField will be enforced, regardless whether you have a standard or custom controller.

As per the documentation (and Keith's Answer):

VisualForce will also remove fields for which users do not have FLS visibility when rendering edit pages. Additionally, all apex:inputField tags will be rendered as read-only elements for fields that are set to read-only through FLS. Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS

  • Boris, its a standard controller with extension class.
    – AJoshi
    Commented Jun 13, 2018 at 5:58
  • You'll have to handle the CRUD/FLS yourself Commented Jun 13, 2018 at 6:14
  • 2
    Can you clarify a bit more that apex:inputField respects FLS settings whatever the controller is? So it is fields that are not being presented (via apex:inputField) but are being update by the controller that require the explicit FLS checks.
    – Keith C
    Commented Jun 13, 2018 at 8:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .