I want to display the attachment for guest user context. I will try to render the attachment with attachmentId, but the image will be broken. If I opened the image in new tab it throws, Authorization Required error.

Work around :

I have queried the account's attachmentId and display the attachment as image in lightning component.

<img src="{!'/servlet/servlet.FileDownload?file='+ attachmentId}"/>

I ran the app in force.com sites and public community context, the both context will be getting the same issue (Authorization required access and image broken issue).

Here I attached the image. Please look into it.

  1. The attachment is display in site user context.

Attachment Broken Image ,

  1. When I try to open the image in new tab. Authorization Required page

Note : We can't provide the view all permission to Standard and custom Object. If any one give solution for this. I will really appreciate.


We need to create a sharing rule on Account object for Guest user with read access.

Refer the below image which explain more details to you.

enter image description here


For ContentDocument:

I think @KSL is on the right track with respect to sharing, but I believe your guest user already has some level of Account access, given that you're able to see the fields, just not the content associated with the Account. I think what you're looking for is a ContentDocumentLink record where the ContentDocumentId is a reference to the content in Salesforce, and the LinkedEntityId is set to the user ID of the site guest user.

For Attachment:

Access to attachments is dependent on the sharing configuration of the parent object. As long as your guest user has access to the parent record, they should have access to the child Attachment records. You'll need to check the isPrivate field on the Attachment record to see if it is viewable beyond the owners and users with "See all Data" permissions:

  • Indicates whether this record is viewable only by the owner and administrators (true) or viewable by all otherwise-allowed users (false). During a create or update call, it is possible to mark an Attachment record as private even if you are not the owner.
  • The OP is asking about the Attachment object, not the Content objects – David Cheng Nov 15 '20 at 18:31
  • Thanks, @DavidCheng, I've updated my answer. – EvanSteeleSFDC Nov 16 '20 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.