Scope and Visibility of @RemoteAction Methods
Don’t use globally exposed remote actions to perform sensitive operations or to expose
nonpublic data. Global remote actions can only call
other global methods. You can’t use public remote
actions in global components, or in a global scope. Scope escalation results in a compiler error, or
for references that are resolved at runtime, a runtime failure. This table describes the restrictions.
@RemoteAction Scope | Visualforce Page | Non-Global Component | Global Component | iframe | Access Across Packages |
---|---|---|---|---|---|
Global Remote Method | Allowed | Allowed | Allowed | Allowed | Allowed |
Public Remote Method | Allowed | Allowed | Error | Error | Packages must share the namespace. Method must have the @namespaceAccessible annotation. |
When
remote actions are accessed via markup they are included indirectly via components, the <apex:include>, or the <apex:composition> tags. The scope of the remote method is
carried forward into the top-level container (the top-level item in the inclusion hierarchy),
which must abide by scope escalation rules.
Top-Level Container | ||||
---|---|---|---|---|
@RemoteAction Accessed From | Visualforce Page | Non-Global Component | Global Component | iframe |
Global Component | Allowed | Allowed | Allowed | Allowed |
Non-Global Component | Allowed | Allowed | Allowed only if non-global component doesn't include public remote methods. | Allowed only if non-global component doesn't include public remote methods. |
<apex:include> <apex:composition> | Allowed within the same namespace; error if namespaces are different and the included page or its child hierarchy contains public remote methods. | n/a | n/a | Error |