Apex bypasses field-level security?

Question

Can an apex code, invoked by a non-admin user, perform an update on a field that has a field-level security of visible and read-only for non-admin profiles?

If so, what is permitted/restricted by the above field-level security?

Answer 1

The edit access to the record is determined by the sharing access granted to the user, unless you declare the apex class as without sharing.

Apex executes in system mode so it would override FLS and be able to write to the field.

The FLS Read Only will apply to a user having the said Profile editing the record via the UI http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS

Answer 2

Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.​

For more detail you can visit this link

Answer 3

By declaring the Apex Class by without sharing keyword.

See Using the with sharing, without sharing, and inherited sharing Keywords