My colleague and I were reviewing the Apex Class Security Overview.

Per our understanding of the page, if a user does not have permission to access VisualForce page's controller, he should not be able to view the page.

But then we create a page with a very simple controller and upon experimentation found that it didn't matter whether the User had any permission's related to the controller, but rather whether his Profile gave him permission to view the page itself; once he had this, controller permission was irrelevant.

So it is clear that either this page is inaccurate or outdated, or we don't understand it correctly.

Can anyone explain this topic better?


While what you stated about visualforce pages may hold true, you can still call classes using things such as AJAX from other locations such as links, buttons, etc. So lets say you have a custom button on a page layout, this button, if it calls a class, the user's profile will need access to that class otherwise it will thrown you an insufficient error


Each request to salesforce only checks the first element involved in the request. For a page, this means that in the context of a Visualforce transaction, you have access to the controller, extensions, and component extensions. Using execute directly on a class requires access to the class itself (see the Ajax Toolkit for the execute function), as does a web service call or REST call. Remote actions run in Visualforce context and are therefore accessible from a page that has access to those functions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.