Salesforce Decode
Salesforcedecode
Back to questions
ApexAdvancedsecurityflsrest-api

Enforce field-level security in Apex REST endpoints serving mobile clients

Real World Scenario

Penetration test found mobile REST API returning Contact.Social_Security_Number__c to authenticated users whose profile hides the field in UI.

Expected Answer

• Security.stripInaccessible on all SOQL results before JSON serialization • USER_MODE DML and queries in REST resource methods • Never trust client field list—server defines allowed response schema • Separate DTO classes exposing only permitted fields per API version • runAs tests per profile verifying stripped fields absent from response • PMD ApexCRUDViolation and ApexDangerousMethods in CI pipeline • API changelog documents field additions requiring FLS review

Follow-Up Questions & Answers

Click to expand — each follow-up includes a direct, interview-ready answer

Main difference: use case and scale. Security.stripInaccessible on all SOQL results before JSON serialization. USER_MODE DML and queries in REST resource methods. Pick based on your integration pattern and team capability. REST bypasses UI field security—stripInaccessible on every user-facing query is non-negotiable. Optimize for scale and operational observability.

Architect Perspective

REST bypasses UI field security—stripInaccessible on every user-facing query is non-negotiable.