I have a VF page that is (supposed to be) privileged to authenticated Customer Portal users, but when I clear my browser's cookies and enter the URL for the page, I get immediate access without being challenged for authentication.
So, why do I expect to get a login screen instead? Because when I:
- Go to
Develop
>Sites
> my portal site - Click on
Public Access Settings
to get to the guest profile - Click on
Visualforce Page Access
The page is not listed there, only the standard FileNotFound
, ForgotPassword
etc. pages
The page controller is also not authorised for the Guest user and it is declared
public with sharing class sourcesController {
More information that might be relevant:
The page in question is the Active Site Home Page
and it used to work properly. Up to recently it was protected from public browsing (ie visitor get's prompted to log in and then routed to the page). Not sure what broke the security.