Users on our Force.com site are receiving errors (Unauthorized/401 error) whenever we release a new version of a Visualforce page/Component

Question

When we release a new version of the primary visualforce page of our Force.com site (or certain components), users on those pages get an Unauthorized/401 error.

This seems to only happen on pages where there is dynamic content being loaded into the VF page. In other words, when there are API calls being made without the page being reloaded.

For example, on our contact form, customers choose categories to describe their issue, then we suggest articles that might solve their issue. The articles are loaded dynamically without refreshing the page.

If we release a new version of the VF page template, all users currently on the contact form page will receive an error when they go to Submit the form (which inserts the case into Service Cloud via an Apex class).

How do we release new versions without giving users an error?

Answer 1

Any view state from the controller present in the user's browser (a big mash of a hidden field within a element on the page) can't be deserialized by a new version of your controller and/or VF page when the user invokes an action method. (ex. they loaded the page with Version 1 of your controller and page, and now they're trying to deserialize that view state with Version 2 of the controller and page)

Unfortunately, I don't believe there is an answer here other than to pretty up the Sites error page and suggest that they 'start over' with whatever they were doing.

Depending on your use case, you might be able to get by with no view state by marking all of your controller properties as transient -- but even then, you might still hit a problem with deserialization when invoking an action.

Or you can forgo traditional conventional Visualforce patterns and replace <apex:form> with your own <form> that you process using the form fields available on ApexPages.currentPage().getParameters()