We have a force.com site and we are displaying some products based on the user logged in.
- We are being passed in the user id from some portal.
- We are consuming this user id by creating a cookie and encrypting the user id in vf page controller.
- Once cookie is created,we are redirecting the user to another page and accessing the cookie there and displaying the products that own.
This design was done 5 yrs ago and out of the blue it started working in weird way in our production recently.
Everytime user refreshes the page, he/she can see the data of a different user. It is detecting a different user upon refreshing and showing different products.
We cannot reproduce the issue in lower environments.
- Is there any other way to send data between pages other than url parameters? Security team doesn't want to expose the user id even in encrypted form. So url parameters is not a way.
Since it is a high priority issue in prod, quick workaround is expected. As of now, we have turned the site into maintenance to prevent users from seeing wrong info.