0

Is it secure to build SOQL queries on front-end side (lwc component) and pass them to Apex for execution?

Improve this question

1 Answer 1

Reset to default
4

It depends on how the query is used. When passing to Apex, make sure you use inherited sharing on the class, and Security.stripInaccessible to ensure users can't see fields/records they're not supposed to. In addition, make sure the user doesn't have access to any unnecessary fields or objects. As long as your configuration is perfectly secure, constructing a dynamic SOQL is just as secure. After all, a tech-savvy user could just use the console directly to attempt to perform a query by calling the ui-api directly. There's no additional harm that can be done by building a dynamic query if everything is locked down the way it should be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .