Authorization required error on public site insert form custom object

Question

Note: This is in continuation of previous Q: Why are Visualforce pages rendered empty on site?

I get the following error :

I have a custom object: Orders

I have built a fisualforce for it, for inserting data by site guests.

<apex:page showHeader="false" sidebar="false" StandardController="ChargentOrders__ChargentOrder__c">
<apex:sectionHeader title="Choose your plan" subtitle="New Order"/>
  <!-- Begin Default Content REMOVE THIS -->
  <apex:form >
  <apex:pageBlock title="Order Edit" mode="edit">
  <apex:pageblockButtons >
  <apex:commandButton action="{!save}" value="Submit"/>
    <apex:commandButton action="Cancel" value="Cancel"/>
   </apex:pageblockButtons>
  <apex:pageblocksection >

  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Payment_Method__c}"/>

  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Charge_Amount__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Billing_First_Name__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Billing_Last_Name__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Billing_Address__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Billing_Zip_Postal__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Card_Number__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Card_Security_Code__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Card_Type__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Card_Month_Indicator__c}"/>
  <apex:inputField value="{!ChargentOrders__ChargentOrder__c.ChargentOrders__Card_Expiration_Year__c}"/>



  </apex:pageblocksection>
  </apex:pageblock>
    <apex:pageBlock rendered="NOT({!$ObjectType.ChargentOrders__ChargentOrder__c.accessible})">
        <p>Sorry, but you cannot see the data because you do not have access to the Lead object.</p>
    </apex:pageBlock>

  </apex:form> 

  <!-- End Default Content REMOVE THIS -->
</apex:page>

This code, in return looks like this:

I have created a public site, granted access to guest user, no login set.

The custom object has no mandatory fields, has lookup field for Account.

I granted access to account object.

The custom object has access as well

Where to look now?

Answer 1

The code for the methods used in a basic site controller should look like the following:

 */
global with sharing class SiteLoginController {
    global String username {get; set;}
    global String password {get; set;}

    global PageReference login() {
        String startUrl = System.currentPageReference().getParameters().get('startURL');
        return Site.login(username, password, startUrl);
    }

    global SiteLoginController () {}
}

The fact that you're not setting a login for a unique guest user may be a part of the issue (its an option; a guest doesn't have to register their info and may only be required to register a PW as best as I can recall).

You're allowing someone who's unknown to SF (and essentially untraceable) to come in and create a new order or edit an existing one on your site. This doesn't sound like a "best practices security approach" toward handling this type of situation to me at all.