RestResource Class with sharing keyword

Question

I am having rest resource class on site in which I am querying contacts and leads. I am able to query contact records when class is without sharing but not able to query contact records when class with sharing. Whereas able to fetch leads record even if my class is with sharing.

Please guide me whether I am missing some access for contact as site user. I have checked field access, object access and also sharing setting, all are fine. Sharing setting for contact is 'Controlled by parent' and account is 'Public read/write'.

Class for reference:

@RestResource(urlMapping='/QueryRecords/*')
global with sharing class QueryRecords{
     @HttpPost
     global static void updateRecords(){
          String mobile = RestContext.request.getParameters().get('Mobile');

          List<Contact> contactList = new List<Contact>();
          List<Lead> leadList = new List<Lead>();
          List<Task> taskList = new List<Task>();

          contactList = [SELECT Id, Name FROM Contact WHERE MobilePhone =: mobile];
          leadList = [SELECT Id, Name FROM Lead WHERE MobilePhone =: mobile];

          for(Contact obj : contactList){
               Task objTask = new Task();
               objTask.whoId = obj.Id;
               objTask.Description = mobile;
               taskList.add(objTask);
          }
          if(taskList.size() > 0){
               insert taskList;
          }
     }
}

Answer 1

This is, indeed, weird behavior.I assume your site is using a Guest User. I found this question How to make all contacts visible to the sites guest user? that might help resolve the problem. Try creating a Group and add the Site's Guest User to it. Then create a sharing rule to share all of the Contacts with that Group and allow some time for recalculation. This should help.