ApexAdvancedsecurityflsrest-api
Enforce field-level security in Apex REST endpoints serving mobile clients
Real World Scenario
Penetration test found mobile REST API returning Contact.Social_Security_Number__c to authenticated users whose profile hides the field in UI.
Expected Answer
• Security.stripInaccessible on all SOQL results before JSON serialization
• USER_MODE DML and queries in REST resource methods
• Never trust client field list—server defines allowed response schema
• Separate DTO classes exposing only permitted fields per API version
• runAs tests per profile verifying stripped fields absent from response
• PMD ApexCRUDViolation and ApexDangerousMethods in CI pipeline
• API changelog documents field additions requiring FLS review
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. Security.stripInaccessible on all SOQL results before JSON serialization. USER_MODE DML and queries in REST resource methods. Pick based on your integration pattern and team capability. REST bypasses UI field security—stripInaccessible on every user-facing query is non-negotiable. Optimize for scale and operational observability.
Architect Perspective
REST bypasses UI field security—stripInaccessible on every user-facing query is non-negotiable.