We're developing a site, with vf pages and controllers. I'm curious if anyone is able to develop in this environment, accessing Opportunities and Contacts, plus some custom objects, without resorting to the without sharing class settings?

I feel it's a cop-out, 'just switch off security', yet I'm at a loss how to actually get access to data with sharing controls enabled.

I've set all the permissions I can for the Opportunity object, so I can read it, but this fails in Test:

    static void TestFieldAccess() {
        Contact c=createContact();
        Opportunity o=createOpp(c);
        // test as system
        o = [select id from opportunity where id=:o.id];
        // test as portal user
        System.runAs(getPortalUser()) {
            Opportunity test_o = [select id from opportunity where id=:o.id
                WITH SECURITY_ENFORCED];

Does anyone actually run site controllers with sharing ?

1 Answer 1


As far as object permissions, you can go to the Site configuration page in Setup, and configure Guest Access, which is a special user associated with your Site.

You can also enable your Site for login, in which case individual users can also be configured by Profile, Permission Set, and Sharing Rules. This login capability requires appropriate licenses; you'll need to contact Sales to find out how much it'll cost.

Note that Portal Uses do have some limits on CRUD permissions you can set. Sites and Site.com User Licenses describes the various license types.

without sharingis indeed undesirable. However, sometimes it is the only path forward. If you can't do whatever it is you need to do with licenses, this may be your only option. Just remember that you're responsible for your own data security if you go this route.

  • Our experience was that to use guest user all apex code had to be either without or inherited sharing (after a change Salesforce made a year or so ago).
    – Phil W
    Sep 10, 2022 at 13:02
  • Yeah, that sounds like the right way, I'll see what I can get working!
    – Dave Smith
    Sep 12, 2022 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .