SOQL (Salesforce Object Query Language) is a powerful tool used for querying Salesforce data, but it can also be a point of security concern if not implemented correctly. A core way to secure your SOQL is to use the WITH SECURITY_ENFORCED clause. The above clause ensures that the current user’s FLS and OLS are intact. If you use WITH SECURITY_ENFORCED, the query will return only fields and rows that the user can access, preventing unauthorized data exposure.
Apart from writing the WITH SECURITY_ENFORCED developers can also write WITH USER_MODE clause. This allows for FLS, but provides a flexible way to control access at a data level and is a good way to approach this. It behaves like a WITH SECURITY_ENFORCED but in some cases, it can give you a point like when you want to implement FLS without the overhead of checking share rules.
Check out post – Enforce Object-level and Field-level permissions in Apex to understand with and without security in Apex.
Difference Between With Security and Without Security
The only difference between “with security” and “without security” in Apex is how your code respects user permissions and sharing rules.
With Security
When your SOQL queries use WITH SECURITY_ENFORCED, the code respects the permissions of the user. This means that only the fields and records to which the user has access will be returned. It is important are known to assure the foundational security policies are achieved and sensitive data is protected from an unapproved access.
List<Account> accounts = [SELECT Name, Email__c FROM Account WITH SECURITY_ENFORCED];
// Fails if the user lacks field or object access.
Without Security
Apex Executes in System Mode, which ignores the permissions of the running user. By defining a class with the without sharing keyword, it also goes against sharing rules, meaning the code can see all data without regard for the user’s access rights. Although this would help in admin task or getting some larger data but it is a serious security risk if not handled properly.
List<Account> accounts = [SELECT Name,Email__c FROM Account];
// Retrieves data regardless of user’s permissions.
| Aspect | With Security | Without Security |
|---|---|---|
| Field-Level Security | Enforces FLS automatically | It does not enforce FLS; and may expose restricted data. |
| Object-Level Security | Enforces OLS automatically | It does not enforce FLS; and may expose unauthorized objects |
| Error Handling | Throws an exception if access is restricted. | Retrieves data even if the user lacks access. |
| Use Case | Recommended for user-facing scenarios or integrations. | Suitable for backend operations where admin access is ensured. |
Few Other Steps for secure SOQL
- Bind Variables: Use bind variables for all your queries to avoid SOQL injection vulnerabilities.
- Limit And Offset: Use LIMIT to reduce the number of records retrieved and save system performance
- Field Accessibility Checks: Schema CheckfieldLevelSecurity: Use
Schema.DescribeFieldResultto check FLS before querying sensitive fields.
Summary
SOQL Queries with WITH SECURITY_ENFORCED ensures that we adhere to Salesforce’s security model and prevent any sensitive data leakage maintaining trust. Never skip security unless necessary, such as backend processes specific to admins only.
Related Posts
- Secure Apex Code with User Mode Operation
- Best Practices to Avoid Hardcoding in Apex for Cleaner Salesforce Code
- Enforce Object-level and Field-level permissions in Apex
- Top 5 Session Security for LWC
- Basics of Securing Salesforce Application
Related Questions Posts
- What is PK Chunking?
- What is SOQL Injection?
- Types Of Integration Patterns in Salesforce
- Difference between On-Demand Email-to-Case and Email-to-Case?
- Interview Questions for Tech Lead /Salesforce Architect Interview – II
- Salesforce Interview Question for Asynchronous Apex
- Salesforce Integration Interview Questions
- Salesforce Apex Interview Question
- Salesforce Interview Question – Security
- Top 20 Salesforce Developer Interview Questions
- List Custom Settings Vs Hierarchy Custom Settings In Salesforce
- Difference Between Workflow and Process Builder In Salesforce Development
