I created a lightning component which has a simple recordEditForm to allow users to edit/create contacts. Using lightningOut, I embedded it in a VF page, and then exposed the page to a Force.com site. It works perfectly in a container app in Lightning and in the VF page within Salesforce, but when I access from Sites, it only works when there is no record id - ie creating new contacts works, but retrieving existing ones doesn't. The form never loads, and in the messages tag I get only a red area with: [object Object].

I have put without sharing on the Apex controller, thinking that it was a sharing issue, and verified that the controller is enabled for the site.

The console shows the following errors:

action: null
component: "lightning:recordEditForm"
componentStack: "[lightning:recordEditForm]"
data: null
handled: false
id: 2088159026
message: "Error in fetching record or record metadata. [[object Object]]"
name: "AuraFriendlyError"
of: "Object.eval()@https://ananim2019-relief.cs42.force.com/components/lightning/recordEditForm.js:6:241↵ha.error()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:31612↵va._errorWithErrorHandling()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:32095↵eval()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:33722↵va.emitError()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:33676"
reported: true
severity: undefined
stackFrames: (6) [d, d, d, d, d, d]
stackTrace: "Object.eval()@https://ananim2019-relief.cs42.force.com/components/lightning/recordEditForm.js:6:241↵ha.error()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:31612↵va._errorWithErrorHandling()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:32095↵eval()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:33722↵va.emitError()@https://ananim2019-relief.cs42.force.com/components/force/lds.js:2:33676"
stacktraceIdGen: "lightning:recordEditForm$Object.eval"
tg: (6) [d, d, d, d, d, d]
__proto__: TB


Does anyone have any ideas?
  • 1
    Did you try whitelisting Salesforce itself in Setup -> Trusted Sites or with CORS settings? Whitelisting *.visual.force.com might do the trick May 20, 2019 at 18:26
  • Thanks for the suggestion, but no luck. It doesn't seem to be sharing either because if I enter an id for a contact that is owned by the site user, it throws the same error.
    – hgolov
    May 20, 2019 at 18:52

1 Answer 1


The Lightning Component Library indicates that this component is only supported in Lightning Experience (sometimes also referred to as one.app):

Lightning Experience, Lightning Communities, Salesforce Mobile App

Components that provide support for Lightning Out Visualforce pages include

Lightning Out / Visualforce

in that section.

The component behavior when surfaced in an unsupported experience is more or less undefined. While it's possible you can achieve behavior changes by altering the Site Guest User Profile or your Organization-Wide Defaults or Sharing Rules on Contacts to ensure that records are visible to an implementation that fully enforces all sharing rules, FLS, and CRUD, I would recommend against relying upon it due to the lack of built-in support for this use case and the damage that such changes would wreak on your security.

Modifying your Apex controller should not impact the built-in component's behavior, because <lightning:recordEditForm> is not calling your Apex but using its own implementation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .