Standard Controller with Extension Vs with Sharing extention

Question

I am not clear with below two concepts - are both actually same?

Standard Controller with Extension

Although a controller extension class executes in system mode, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply.

With Sharing

Use the with sharing keyword when declaring a class to enforce sharing rules of the current user. Explicitly setting this keyword ensures that Apex code runs in the current user context.

The only difference I see in "Standard Controller with Extension" is, this also runs in User context, but ensure User Permissions and FLS are enforced.. Whereas, with sharing only enforce sharing settings of the User and doesn't care about Object access or FLS of the user..

Is my understanding correct? kindly help!

Answer 1

A controller extension (that extends a standard controller) will look lke this in Apex:

public class MyControllerExtension {
  public MyControllerExtension(ApexPages.StandardController ctrl) {..}
  public PageReference actionMethod1() {..}
  public void actionMethod2() {..}
}

and in a VF page as

<apex:page standardController="Contact" extensions="MyControllerExtension">
.. markup
</apex:page>

If either the VF page includes an action of the form:

action="{!save}"  // or any of the other standard controller actions 

OR

the controller extension uses apex of the form

this.ctrl.save(); // or any of the other standard controller actions

THEN per the VF doc you cited

those actions will:

executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply.

but if the controller extension does its own querying or DML within its action methods or getters, then that logic executes in system context and you are responsible for FLS.

Sharing mode on the class definition will determine record visibility in queries