We have a Force.com site where we enabled login options and for the forgot Password link on the login page settings we have added a custom Forgot Password page.

When I try to navigate to this Forgot Password page(using sites), the page doesn't open and instead it redirects me to an Unauthorized page stating: "Authorization Required ('You must first log in or register before accessing this page)"

  • We have checked site profile settings, security settings and profile access for custom Forgot Password page and everything seems ok.
  • Debug logs are not showing anything useful.
  • Cache attribute too is set to false

Any clue or directions here?

  • 3
    Sites will "Authorization Required" rather than disclosing error messages which could yield details of your code. Go to Setup > Monitoring > Debug Logs and create one for the Site Guest User - this might give you some more insight into what is failing. May 8, 2013 at 9:48
  • 1
    Is the custom page added to the guest user profile of the site ? May 8, 2013 at 10:39
  • 1
    Generally the debug logs for force.com sites are rubbish, whenever I have had this (and all profile and config settings are correct) it has been due to the controller / class throwing an exception that is not handled. Have you tried accessing the page from within SFDC i.e. apex/PageName in your browser and check the logs to ensure no expections are being thrown May 8, 2013 at 10:53
  • 1
    @user320 : Thank you! As mentioned in my main post, I already tried that and the Debug logs are not showing anything useful. May 8, 2013 at 16:34
  • 1
    @Sdry : Thank you! yes the page is already added/enabled for guest user profile. May 8, 2013 at 16:35

2 Answers 2


This is nearly always down to an exception being thrown, and that can be down to things like field level security.

It seems odd that there's nothing in the logs, you should definitely see an exception there but the things to check are:

  • Permissions for objects used in the controller/page
  • Field Level Security for objects used in the controller/page (so easy to get a null value here and hence a null dereference). FLS for sites is accessed via the site guest profile and isn't listed in the main profile list
  • Check that there's not a redirect happening to a page the guest profile DOESN'T have access to
  • Thank you! The page is almost clone of standard forgot password page. So no issue of FLS or etc. Post reset password submit there's redirection to password confirm page, but that too is enabled for guest profile. May 9, 2013 at 4:45
  • If it's basically a copy of that then I'd suggest doing a diff between the two as it'll be one of the differences that's breaking things!
    – Matt Lacey
    May 9, 2013 at 5:06
  • Ok will do. PS: 1 in 100 times the page worked. And I tried Abhinav's 3rd approach (listed at tgerm.com/2010/10/debugging-sites-authorization-required.html) and it resulted in error "System.VisualforceException : Page not allowed for the profile" - but I'm sure its enabled for guest profile and customer portal profile too. May 9, 2013 at 6:00

Are you referring to any resource like an image which requires salesforce authentication in your forget password page?

  • 1
    nope. I tried an empty page with just apex:page line and it still says authorization required. May 8, 2013 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .