I have created two visualforce pages, Vf1 and Vf2. I have included Vf2 page in Vf1 page by using 'apex:include' tag. I have given permission set to a child user to access Vf1 page only, but he is able to access Vf2 page also(I can see 'no access' option for Vf2 page in permission set).

I have found below article regarding apex:include option:


Does anyone know, how to restrict the Vf2 page access even though it's included in Vf1 page through permission sets.


Short answer, you can't.

Longer answer, as mentioned in the documentation you linked to, Visualforce page permissions are checked at the top level only. If you have access to the top level (Vf1 in your example) then you have access to everything that it depends on when accessing that page (which means you have access to Vf2).

Permission for a Visualforce page is checked at the top level only. Once users can access a page, they can execute all Apex that’s associated with the page. This includes:

  • The controller for the page and any Apex classes called from the controller class.
  • Any extension classes for the page and any Apex called from an extension.
  • Any Apex classes associated with custom components within the page.
  • Any classes associated with the page through the use of apex:include or apex:composition.

You could use the rendered attribute on your apex:include and query if they user has appropriate permissions in your controller, but that would end up being messy.

I would recommend that you re-think your approach and instead consider having two completely separate Visualforce pages one which includes Vf2 and one which does not. Then you can assign the permissions as you desire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.