While going through manuals, it was mentioned Many times that apex classes will not consider security of logged in user but it will run in system mode and we should add custom controller extension to apply security of logged in user . At the same time it is mentioned that every class has the value with sharing (default value ), which means that sharing keyword will apply security of logged in user

what is correct ? does apex classes apply security of logged in user how to apply logged in user security ????

  • here is the resource for extension Commented Jun 12, 2019 at 8:07
  • You want to build a Visualforce page that respects user permissions. Although a controller extension class executes in system mode, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply. Commented Jun 12, 2019 at 8:07

1 Answer 1


Apex classes currently do not apply profile or permission set constraints - so the "CRUD" (Create, Read, Update, Delete) and "FLS" (Field Level Security) aspects of security are not applied. Thus, a user without permission to access Accounts at all can still run Apex code that queries a bunch of Account instances and returns some data to the UI.

On the other hand, Apex classes will apply Sharing Rules, thereby filtering out instances from the results of SOQL or SOSL queries based on those rules, when they are declared "with sharing" or when inheriting sharing from the caller.

Note that the use of standard "field" handling components in pages (be that Visualforce or Lightning) for presenting input or output fields WILL actually apply CRUD and FLS, so for example if the user has no access to the Account's Name, an attempt to provide an input for the name using a standard "field" handling component could actually either show the name as read-only or hide it altogether, depending on the CRUD/FLS for that field for the given user.

On the other hand, if you write your own components or use (standard or third party) components that are not for field handling, you have to deal with the CRUD/FLS aspects for yourself.

  • thanks alot , so helpful. would it be different ids the controller was standard or custom ? Commented Jun 13, 2019 at 6:35
  • No, the ID is set by the insert of the object.
    – Phil W
    Commented Jun 13, 2019 at 6:40
  • Ah, I think I misunderstood you. I think you meant "if" instead of "ids"? If so, again "no" - it comes down to the markup you use in the visualforce page. If you use <apex:inputField .../> or <apex:outputField .../> these automatically apply FLS for you.
    – Phil W
    Commented Jun 13, 2019 at 8:49
  • yes that exactly what i meant , thank u it is clear now Commented Jun 15, 2019 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .