Apex Classes Enforce Sharing Rules by Default

Take advantage of an enhanced Apex security model that protects your data through default record access enforcement. Apex classes without an explicit sharing declaration now default to with sharing mode, which enforces org-wide sharing settings and custom sharing rules. In earlier API versions, Apex classes without an explicit sharing declaration default to without sharing mode, with some exceptions. The without sharing mode bypasses sharing rules and allows the current user to access all records.

Where: This versioned change applies to API version 67.0 and later. The change applies to Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.

Why: The new “secure by default” security paradigm prevents data visibility risks that can occur if you omit sharing declarations on Apex classes. To bypass sharing rules, you must now have an explicit without sharing declaration on the Apex class. This requirement promotes intentionality and ensures that you use the without sharing declaration only when necessary.

How: To determine an Apex class’s sharing mode with confidence, we recommend that you always include an explicit sharing declaration. Otherwise, these factors determine the sharing mode of an Apex class without an explicit sharing declaration.

• If you compile the Apex class in API version 67.0 and later, then an omitted sharing declaration defaults to with sharing. If the class inherits from another class, its sharing mode is defined by the parent’s sharing mode.
• If you compile the Apex class in API version 66.0 and earlier, then an omitted sharing declaration defaults to without sharing. However, these exceptions apply.
  • If the class is part of an inheritance chain, and any class in that chain is saved as API version 67.0 and later, an omitted sharing declaration defaults to with sharing.
  • If the class is an Aura controller or an @AuraEnabled method called from a Lightning web component, an omitted sharing declaration defaults to with sharing.
  • If the class isn’t an Apex entry point, its sharing mode is defined by the sharing mode of the calling class.