I was wondering if somebody has already dealt with this critical update:

When this critical update is activated, an authenticated user can access an @AuraEnabled Apex method only when the user’s profile allows access to the Apex class. This critical update enforces user profile restrictions for Apex classes used by Aura and Lightning web components.

From the look of it all apex classes that contain @AuraEnabled methods will have to be added to the profiles that need to access those.

Is the best approach to add the classes to the profiles? Or maybe tackle this with a permission set?

  • 2
    Permission sets seem a far better approach especially given that these can be easily combined together. The real shame is that they don't support assignment via profiles but rather must be assigned by user.
    – Phil W
    Commented Oct 7, 2019 at 21:32
  • 1
    Phil - there is an idea out for this. I encourage everyone to up-vote this one. success.salesforce.com/ideaView?id=0873A000000Ts2mQAC Commented Oct 7, 2019 at 22:02
  • 3
    There's a new tool out to help identify apex classes in an org affected by this critical update: github.com/forcedotcom/AuraEnabledScanner
    – Mark Pond
    Commented Jul 30, 2020 at 16:35


You must log in to answer this question.

Browse other questions tagged .