Community Guest User able to create records without create permission

Question

We ran into a scenario where a community (Salesforce Tabs + Visualforce) user opens multiple tabs and is logged out on one tab. When the user goes to another open tab and performs an action on a Visualforce page via RemoteAction, it is being carried under the Site/Community Guest User account.

• The Guest User doesn't have permission to the Visualforce page, but it is set as Site Active Home Page. I'm not sure if that is somehow giving the guest user access.
• The Guest User doesn't have permission to create records for that object. At profile level permissions it shows as 'No Access'. But still able to create records. There are no permission settings assigned.
• Is there any way to redirect the user to login page on all open tabs after logging out on one tab?

Answer 1

Is your server side Apex Class that the Remote Action is calling using the "with sharing" keyword?

for example:

public with sharing class MyClass {

    @RemoteAction
    public static void DoSomething(){}

}

Answer 2

Why not check if the current user has permission to access that Object? If not then redirect?

public with sharing class MyClass {

    @RemoteAction
    public boolean void DoSomething(String accountName){}
        if(Schema.sObjectType.Account.accessible){
            //Do your operation return true
        }else{
            return false;
        }
    }
}

JS CODE: Visualforce.remoting.timeout = 120000; // Set timeout at page level

    function getRemoteAccount() {
        var accountName = document.getElementById('acctSearch').value;

        // This remoting call will use the page's timeout value
        Visualforce.remoting.Manager.invokeAction(
            '{!$RemoteAction.AccountRemoter.DoSomething}',
            accountName, 
            handleResult
        );
    }

    function handleResult(result, event) { 
        if(!result){
        //Rediret to login page
        window.location.href = "http://loginpage.com";
        }
    }

Source: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm