5

I have a VF page that is (supposed to be) privileged to authenticated Customer Portal users, but when I clear my browser's cookies and enter the URL for the page, I get immediate access without being challenged for authentication.

So, why do I expect to get a login screen instead? Because when I:

  1. Go to Develop > Sites > my portal site
  2. Click on Public Access Settings to get to the guest profile
  3. Click on Visualforce Page Access

The page is not listed there, only the standard FileNotFound, ForgotPassword etc. pages

The page controller is also not authorised for the Guest user and it is declared 

public with sharing class sourcesController {

More information that might be relevant:

The page in question is the Active Site Home Page and it used to work properly. Up to recently it was protected from public browsing (ie visitor get's prompted to log in and then routed to the page). Not sure what broke the security.

Improve this question
3
  • 3
    Don't quote me on this, but I'm fairly sure that "Active Site Home Page" implies anonymous access is allowed. Despite the behavior you describe, I am fairly certain that "Active Site Home Page" has allowed anonymous access to that page, at least for as long as I've dealt with public Sites pages (a while). You may need an additional front page that redirects users based on their profile (anonymous vs. authenticated)?
    – jkraybill
    Jul 3, 2013 at 14:48
  • jkraybill - Nope. As I said this used to work fine. The Active Site Home Page was protected. I also just made an experiment and removed it as the home page and I could still browse to it unchallenged.
    – JannieT
    Jul 4, 2013 at 9:30
  • jkraybill, my apologies. It looks like you were right.
    – JannieT
    Jul 12, 2013 at 6:05

1 Answer 1

Reset to default
7
+50

Since the page is set as one of the lookup fields on the Site Detail page that page is automatically enabled for the site.

The related list of Site Visualforce Pages on the Site Detail page has a link to the Enabled Visualforce Page Access Help page which has the following:

If you select a Visualforce page for any of the lookup fields on the Site Detail page, any of the error pages, or the Change Password Page under login settings, that page is automatically enabled for your site. If you remove a page from this list, but it is still selected in one of these places, public users can access that page. To completely remove pages from your site, disable them here and make sure they are not selected in any lookup fields for your site.

One possible explanation for why the page had been unavailable for the Public/Site Guest User could be that there was unauthorized data access being done in the controller which resulted in the page forwarding to the Unauthorized page, giving the appearance of the page itself being inaccessible.

For example, if you have an org-wide default of private for an object and you attempt to access a record of that object in your 'with sharing' controller and the Public/Site Guest User doesn't have access to that specific record then they'd get forwarded to the Unauthorized page.

If something changed and now the controller does not access that record or that record is now available to the Public/Site Guest User they'd no longer be forwarded to the Unauthorized page.

Improve this answer
5
  • +1 for a very good and relevant piece of documentation. Sadly it doesn't help to get my site working as it did before I tinkered with permission settings. Following your lead I have tried having my page in and out of the list of Site Visual Force Pages, but it definitely was my Active Site Home Page when it worked.
    – JannieT
    Jul 8, 2013 at 19:21
  • 1
    Weird. Only thing that I can think of is that you were getting an error -- probably a security related error (e.g., FLS, Object permissions, etc.,) -- when viewing as the public/guest user which ended up redirecting you to the Unauthorized page and now you are no longer getting that error.
    – Peter Knolle
    Jul 8, 2013 at 23:19
  • So just to confirm then: By design, if none of the VF page, it's controlling apex class or the queried objects in the class are allowed public access, but you specify that page as one of your lookup field pages, that data becomes public?
    – JannieT
    Jul 10, 2013 at 6:32
  • The controller and VF page will be available, however the data will not be. For example, if you have an org-wide default of private for an object and you attempt to access a record of that object in your 'with sharing' controller and the public/guest user doesn't have access to that specific record they'll get forwarded to the Unauthorized page. I thought that might be what's happening. For the FLS and object permissions the page will still render, but the data will not.
    – Peter Knolle
    Jul 10, 2013 at 9:59
  • Peter, I can't get my site working as it was, but you did a sterling job of explaining why it is behaving as it does. I guess I will just have to write a custom login screen with rerouting for an intranet-like site. Thanks so much.
    – JannieT
    Jul 12, 2013 at 6:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .