5

I have a VF page that is (supposed to be) privileged to authenticated Customer Portal users, but when I clear my browser's cookies and enter the URL for the page, I get immediate access without being challenged for authentication.

So, why do I expect to get a login screen instead? Because when I:

  1. Go to Develop > Sites > my portal site
  2. Click on Public Access Settings to get to the guest profile
  3. Click on Visualforce Page Access

The page is not listed there, only the standard FileNotFound, ForgotPassword etc. pages

The page controller is also not authorised for the Guest user and it is declared

public with sharing class sourcesController {

More information that might be relevant:

The page in question is the Active Site Home Page and it used to work properly. Up to recently it was protected from public browsing (ie visitor get's prompted to log in and then routed to the page). Not sure what broke the security.

  • 3
    Don't quote me on this, but I'm fairly sure that "Active Site Home Page" implies anonymous access is allowed. Despite the behavior you describe, I am fairly certain that "Active Site Home Page" has allowed anonymous access to that page, at least for as long as I've dealt with public Sites pages (a while). You may need an additional front page that redirects users based on their profile (anonymous vs. authenticated)? – jkraybill Jul 3 '13 at 14:48
  • jkraybill - Nope. As I said this used to work fine. The Active Site Home Page was protected. I also just made an experiment and removed it as the home page and I could still browse to it unchallenged. – JannieT Jul 4 '13 at 9:30
  • jkraybill, my apologies. It looks like you were right. – JannieT Jul 12 '13 at 6:05
7
+50

Since the page is set as one of the lookup fields on the Site Detail page that page is automatically enabled for the site.

The related list of Site Visualforce Pages on the Site Detail page has a link to the Enabled Visualforce Page Access Help page which has the following:

If you select a Visualforce page for any of the lookup fields on the Site Detail page, any of the error pages, or the Change Password Page under login settings, that page is automatically enabled for your site. If you remove a page from this list, but it is still selected in one of these places, public users can access that page. To completely remove pages from your site, disable them here and make sure they are not selected in any lookup fields for your site.

One possible explanation for why the page had been unavailable for the Public/Site Guest User could be that there was unauthorized data access being done in the controller which resulted in the page forwarding to the Unauthorized page, giving the appearance of the page itself being inaccessible.

For example, if you have an org-wide default of private for an object and you attempt to access a record of that object in your 'with sharing' controller and the Public/Site Guest User doesn't have access to that specific record then they'd get forwarded to the Unauthorized page.

If something changed and now the controller does not access that record or that record is now available to the Public/Site Guest User they'd no longer be forwarded to the Unauthorized page.

  • +1 for a very good and relevant piece of documentation. Sadly it doesn't help to get my site working as it did before I tinkered with permission settings. Following your lead I have tried having my page in and out of the list of Site Visual Force Pages, but it definitely was my Active Site Home Page when it worked. – JannieT Jul 8 '13 at 19:21
  • 1
    Weird. Only thing that I can think of is that you were getting an error -- probably a security related error (e.g., FLS, Object permissions, etc.,) -- when viewing as the public/guest user which ended up redirecting you to the Unauthorized page and now you are no longer getting that error. – Peter Knolle Jul 8 '13 at 23:19
  • So just to confirm then: By design, if none of the VF page, it's controlling apex class or the queried objects in the class are allowed public access, but you specify that page as one of your lookup field pages, that data becomes public? – JannieT Jul 10 '13 at 6:32
  • The controller and VF page will be available, however the data will not be. For example, if you have an org-wide default of private for an object and you attempt to access a record of that object in your 'with sharing' controller and the public/guest user doesn't have access to that specific record they'll get forwarded to the Unauthorized page. I thought that might be what's happening. For the FLS and object permissions the page will still render, but the data will not. – Peter Knolle Jul 10 '13 at 9:59
  • Peter, I can't get my site working as it was, but you did a sterling job of explaining why it is behaving as it does. I guess I will just have to write a custom login screen with rerouting for an intranet-like site. Thanks so much. – JannieT Jul 12 '13 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.