Secure Apex Programming

In the previous chapters of this book, we covered ways in which we can improve our Apex code to ensure that we minimize the number of basic errors we receive and also make it easier to handle and deal with them. In this chapter, we are going to finish this first part of the book by discussing how we can make Apex more secure and ensure that users are not able to perform actions that we do not intend for them.

There are many reasons this is important, but the key among them is ensuring that should a user become malicious or their account get compromised, then the damage they can do is limited. I worked with a client who had a faulty website integration design that allowed external users to view all contacts and accounts within the system. Their web developers had noticed this issue and recommended the client get it fixed by a Salesforce consultant (hence my involvement).

At that time, the client was initially unsure of the severity and impact of this security...