While going through manuals, it was mentioned Many times that apex classes will not consider security of logged in user but it will run in system mode and we should add custom controller extension to apply security of logged in user . At the same time it is mentioned that every class has the value with sharing (default value ), which means that sharing keyword will apply security of logged in user

what is correct ? does apex classes apply security of logged in user how to apply logged in user security ????

  • here is the resource for extension – Zahraa jamal Jun 12 '19 at 8:07
  • You want to build a Visualforce page that respects user permissions. Although a controller extension class executes in system mode, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply. – Zahraa jamal Jun 12 '19 at 8:07

Apex classes currently do not apply profile or permission set constraints - so the "CRUD" (Create, Read, Update, Delete) and "FLS" (Field Level Security) aspects of security are not applied. Thus, a user without permission to access Accounts at all can still run Apex code that queries a bunch of Account instances and returns some data to the UI.

On the other hand, Apex classes will apply Sharing Rules, thereby filtering out instances from the results of SOQL or SOSL queries based on those rules, when they are declared "with sharing" or when inheriting sharing from the caller.

Note that the use of standard "field" handling components in pages (be that Visualforce or Lightning) for presenting input or output fields WILL actually apply CRUD and FLS, so for example if the user has no access to the Account's Name, an attempt to provide an input for the name using a standard "field" handling component could actually either show the name as read-only or hide it altogether, depending on the CRUD/FLS for that field for the given user.

On the other hand, if you write your own components or use (standard or third party) components that are not for field handling, you have to deal with the CRUD/FLS aspects for yourself.

| improve this answer | |
  • thanks alot , so helpful. would it be different ids the controller was standard or custom ? – Zahraa jamal Jun 13 '19 at 6:35
  • No, the ID is set by the insert of the object. – Phil W Jun 13 '19 at 6:40
  • Ah, I think I misunderstood you. I think you meant "if" instead of "ids"? If so, again "no" - it comes down to the markup you use in the visualforce page. If you use <apex:inputField .../> or <apex:outputField .../> these automatically apply FLS for you. – Phil W Jun 13 '19 at 8:49
  • yes that exactly what i meant , thank u it is clear now – Zahraa jamal Jun 15 '19 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.