User Interface25% of the exam
Preventing UI and data access vulnerabilities
How to make Apex behind Lightning components and Visualforce respect object, field and record access (user mode, stripInaccessible, sharing keywords), and how to stop SOQL injection, cross-site scripting and CSRF in the UI.
Given a scenario, prevent user interface and data access security vulnerabilities.
~8 min read · 19 practice questions ·
What the exam expects
- For Apex behind a Lightning component, flow or Visualforce page, pick what enforces record access (sharing keywords), object and field access (user mode,
WITH SECURITY_ENFORCED,stripInaccessible, describe checks), or both, and whether it throws or silently drops fields. - Predict an entry-point class's sharing mode with an explicit, inherited or omitted declaration.
- Fix SOQL injection with bind variables or
String.escapeSingleQuotes(), and cross-site scripting with default escaping,JSENCODE/HTMLENCODEor sanitizing base components. - Recognize built-in protection: standard controllers, Lightning Data Service, anti-CSRF tokens, Lightning Web Security.
Key terms. System mode: Apex's default, ignoring the running user's object and field permissions. User mode: a database operation that applies the running user's object permissions, field-level security (FLS) and sharing. CRUD/FLS: object and field permissions. SOQL injection: user input that changes a dynamic query's logic. XSS: attacker-supplied script executed in another user's browser.
Key facts
Apex default
- Detail
- System mode: object permissions and FLS of the running user are ignored
Sharing keywords scope
- Detail
- Record access only; object access and FLS are never enforced by the sharing mode
Omitted declaration, LWC
@AuraEnabled entry- Detail
- Defaults to with sharing; Visualforce controller, REST and async default to without sharing
WITH USER_MODE- Detail
- Enforces object permissions, FLS and sharing; finds all FLS errors, not just the first
WITH SECURITY_ENFORCED- Detail
- Checks SELECT and FROM fields only, throws
System.QueryException, Apex only
stripInaccessible- Detail
- Removes inaccessible fields without an exception; never strips Id; no AggregateResult
User-mode DML
- Detail
insert as userorDatabase.insert(recs, AccessLevel.USER_MODE)throws on missing FLS
Custom Visualforce controller
- Detail
- Runs entirely in system mode; standard controller logic runs in user mode
LDS base components and
lightning/ui*Api- Detail
- UI API responses respect CRUD, FLS and sharing
Dynamic SOQL that can't use binds
- Detail
String.escapeSingleQuotes()on the user input
Sources for this section (8)
- Enforce Object and Field Permissionsdeveloper.salesforce.com (opens in a new tab)
- Sharing Keywordsdeveloper.salesforce.com (opens in a new tab)
- Enforce User Modedeveloper.salesforce.com (opens in a new tab)
- WITH SECURITY_ENFORCEDdeveloper.salesforce.com (opens in a new tab)
- stripInaccessibledeveloper.salesforce.com (opens in a new tab)
- Custom Controllers and Extensionsdeveloper.salesforce.com (opens in a new tab)
- Lightning Data Servicedeveloper.salesforce.com (opens in a new tab)
- SOQL Injectiondeveloper.salesforce.com (opens in a new tab)
- Why doesn't `with sharing` stop a component from showing a field hidden by FLS?
- When should you choose `Security.stripInaccessible` over `WITH USER_MODE`?
- When is the Visualforce anti-CSRF token bypassed?
- Which encoding function protects a merge field written into a Visualforce JavaScript string?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (19 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams