I am working on a lightning application that uses the lightning apex continuation callout pattern found at this link:


The steps we are taking are essentially the same as listed in the article:

1) A lightning "continuation component" contains an aura:method that allows us to perform apex continuations from other lightning components.

2) The "continuation component" has an embedded iframe visualforce page that listens for messages. When one is received from the parent "continuation component" it calls a remote action to begin the apex continuation.

3) The iframe'd visualforce page's controller has a class header of global with sharing. Inside of it is a @RemoteAction annotated method with a global static method signature.

We are observing that the queries in this remote action run in a system context instead of a user context, returning records the current user doesn't have object level access to. It's not clear to me why this is, and I was wondering if anyone here could explain it.


  • What I do is: Aura call -> Controller dispatches "Action" Platform Event -> trigger calls the Callable Action (typically on the Controller again) -> Action method dispatches another "Message" Platform Event -> Lightning empAPI component catches this and informs user the event is complete. If you'd like an example, let me know. – Caspar Harmer Feb 22 '19 at 19:39
  • 1
    Oh hang on... this technique runs as system too. Perhaps retrieve your records first, serialize them and pass to the callable for later processing. Depends on data quantities. Continuations probably do something similar to what I'm describing above, hence the system context. – Caspar Harmer Feb 22 '19 at 19:43
  • Thankfully, I'm not actually worried about it retrieving data in a system context, but I expected a @RemoteAction method in a with sharing class to respect user permissions, and was curious why this would not be the case. – Phil Rymek Feb 22 '19 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.