I've got a controller extension I'm trying to deploy to a public custom url. It works in our sandbox, and I can access it with "Preview" under the custom url, but I get the dreaded Authorization Required message when I try to access it via the public site user.

My question is: How can I find what objects, or other permissions are required? Is it just enable stuff until it works, or can I find the error message somewhere?

The debug logs show my class starting:

16:46:07.4 (35710600)|USER_DEBUG|[13]|DEBUG|Starting work
16:46:07.4 (35730187)|STATEMENT_EXECUTE|[14]
16:46:07.4 (50776332)|SYSTEM_MODE_EXIT|false

but nothing after my line of code:

    System.debug('Starting work');
    Opportunity passed_o = (Opportunity)stdController.getRecord();
    System.debug('Got my record id: ' + passed_o.id);

Where am I supposed to find what's making it stop??


When a Sites application fails with Authorization Required, it is most likely you have an uncaught exception in the page's controller. You should be able to see these exceptions in the site's guest user debug log, or by catching errors and displaying them on an <apex:pageMessages> component.

The possible reasons for this could include:

  • The VF page (or a related page) has not been granted access to the Sites Guest User. You need to go to Setup | Sites | Public Access Settings for the site in question and grant access to this VF page to the site's guest user (which has an implicit profile).

  • The application is attempting to view/update a record where there are not CRUD permissions. Again, check Sites | <the site> | Public Access Settings. Sites guest users are not allowed certain CRUD access to some standard SObjects though this can be mitigated with various techniques including Without Sharing on the class.

  • The application is running afoul of the Security Controls | Sharing Settings | Organizational Wide Defaults + associated sharing rules. You can read more about this in the Record Access Trailhead module

| improve this answer | |
  • So, I'm looking at the Profile for this public site user, and the Visualforce Page Access does show my Visualforce page ProgramPW. I'm guessing this can't be the problem, as my code does start to run. – Dave Smith Sep 10 '19 at 18:38
  • @DaveSmith sorry, I jumped the gun - does the sites guest user have read access to Opportunity and any related objects on the page? Note that unless the class is defined as without sharing, it won't be able to update the Opportunity. Is the site trying to create a new Oppo? Otehrwise, how does it know the OppoId for the getRecord()? – cropredy Sep 10 '19 at 19:10
  • I'm working through the immediate related record types (ie, fields of Opportunity referencing other object types). I'm making sure they have read for this profile. I'm passing id= on the URL. I have with sharing on the apex class. I'm wanting to access existing records, and not needing to create records. – Dave Smith Sep 10 '19 at 19:23
  • I stopped using getRecord and used getId instead. This let my code go further, but it's still not able to get the values from the Opportunity table. The query returns zero rows, whereas the same query in WorkBench returns the full correct row. I'm exporting the profile over to the sandbox and will attempt to reproduce, then fix it over there. – Dave Smith Sep 10 '19 at 20:00
  • 1
    setup | security controls | sharing settings is where you will find OWD – cropredy Sep 10 '19 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.