Until recently we were able to display Attachments to our guest user on our Site using a URL like
Site.getbaseUrl() + '/servlet/servlet.FileDownload?file=' + attachment.Id
But now, we're not sure what's changed (most likely within the past week or so) and this is no longer working.
We were embedding the Attachment in an iframe, but recently began getting browser alerts with an error message like
After some digging it turns out that the link to the attachment is no longer valid (inputting that in a browser's URL gives us an nginx 404 page).
So the current assumption is that for some reason the servlet download is no longer valid, and then whatever runs Visualforce throws a fit and makes the browser send an alert with a nonsensical error message.
To make things more interesting we are unable to reproduce this in Sandbox.
The servlet url just works.
This is not a permanent solution
The production org had been migrated to a new instance (with Winter '21), and therefore all View All permissions for the guest user had been revoked. Including the object to which this Attachment had been attached.
So that's why it couldn't download, and why it still worked in Sandbox.
Simply adding back that permission in Production resolved the issue.
We're still going to need a permanent solution before Spring '21.