1

We have a force.com site and we are displaying some products based on the user logged in.

  • We are being passed in the user id from some portal.
  • We are consuming this user id by creating a cookie and encrypting the user id in vf page controller.
  • Once cookie is created,we are redirecting the user to another page and accessing the cookie there and displaying the products that own.

This design was done 5 yrs ago and out of the blue it started working in weird way in our production recently.

Everytime user refreshes the page, he/she can see the data of a different user. It is detecting a different user upon refreshing and showing different products.

We cannot reproduce the issue in lower environments.

  • Is there any other way to send data between pages other than url parameters? Security team doesn't want to expose the user id even in encrypted form. So url parameters is not a way.

Since it is a high priority issue in prod, quick workaround is expected. As of now, we have turned the site into maintenance to prevent users from seeing wrong info.

|improve this question|||||
  • Is it happening for every user, every time, or is it just happening for specific users? – Mahmood Sep 27 '17 at 20:15
  • How are you getting the userid ? and how are you passing that userid to the controller? – Mahmood Sep 27 '17 at 20:27
1

If the user is already logged in then why not just retrieve it in the landing page's controller (with UserInfo.getUserId()), then pass it to whatever function is querying the user's products?

String UserId = UserInfo.getUserId();
[SELECT Name FROM Products__c WHERE UserId == UserId]
|improve this answer|||||
  • In force.sites you will get Guest user against that and thats it. – Mahmood Sep 27 '17 at 20:18
  • Hmm, I would have thought otherwise if the user was logged in. Are all Force.site users considered Guest? – NorianNyx Sep 27 '17 at 20:20
  • Indeed they are only Guest users, with Guest user profile. check out this for details. – Mahmood Sep 27 '17 at 20:22
  • Perhaps I misunderstood, but it seems like users get assigned to a portal profile after being authenticated? – NorianNyx Sep 27 '17 at 20:36
1

My bad! I misunderstood our problem. The weird behaviour-user seeing data of another user- is because of Salesforce caching Force.com sites, not because of using cookies to transfer data. More information can be found here. help.salesforce.com/articleView?id=sites_caching.htm&type=0. We resolved this issue by marking cache attribute on apex:page tag to false so that user's don't see others data. Original question-securely passing data between pages- remains unsolved.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.