Preventing Community Users from Seeing Standard SFDC UI when using Site.com

Question

I've currently setup a completely custom site.com customer community (not using templates.) The site.com parts work great, but users can still see records in the standard sfdc UI in some scenarios.

Example:

1. User goes to: portal.customdomain.com
2. Redirects to portal.customdomain.com/login
3. After login, redirects to: portal.customdomain.com/s/Home
4. On the home page, user wants to see the detail page for a contract, so clicks and brought to: portal.customdomain.com/s/Contract?id=[Contract.Id]
5. Now that's all fine, but if that user takes the contract id and puts it on the end of the base domain, they are brought to a standard-ish Salesforce page: portal.customdomain.com/[Contract.Id]

I've gone through and hidden all of the tabs for their profile etc. but its still possible to see the SFDC UI if you know a record id or similar. Another example: portal.customdomain.com/001 shows the account list views accessible to the Community users, but even if they don't have access to any list views, they'll get a list of ids for all Accounts that they have access to.

My question: how do I prevent Customer Community users from EVER seeing a standard salesforce page?

Answer 1

I'm assuming that since you are giving the information on Contracts to the user through custom pages, restricting access by profile is not an option. You can rewrite the URL so that the user is not seeing the ID by using the URL rewrite class. This still leaves you open to brute force though.

One option is to create a new page layout for each object you are indirectly giving users access to with minimal information on it, so that if they do manage to get to that page, they won't be able to see anything you don't want them to.

Answer 2

The best solution I have come up with is creating a Home Page Component of type 'Visualforce Area' with Component Position set to 'Narrow (Left) Column'.

The Visualforce page then loads within an iframe in the left side bar on standard sfui. Since the iframe is on the same domain in the community, you can use javascript to redirect the parent. window.top.document.body.hidden = true; window.top.location.href = 'url_to_redirect_to';

You can also get the url of the current page in the controller by using: ApexPages.currentPage().getHeaders().get('Referer');

With that value you could determine 'url_to_redirect_to' from the server side.

There will still be a quick flash where the user can see sfui. By hiding the document body right away, that time is minimized.

I have found a couple sfui pages that don't load the side bar like User Profile and Content Document/Version.