Guest User: Security Policies Enforced

In the past few releases, Salesforce implemented various security settings that comprise an overall public site security policy. In Summer ’20, some settings are auto-enabling in your org, which you can opt out of, though we don’t recommend it. Starting with the next release, Winter ’21, the public site security settings are enabled, and you no longer have the option of opting out. Make sure your org enables all the security settings needed, and test out your implementation.

Block Certain Fields in the User Record for Orgs with Communities and Portals (Previously Released Security Alert and Update, Enforced)
Salesforce is giving customers the option to enable a user setting that allows the hiding of certain personal information fields on the user records in orgs with communities or portals. The fields are hidden from view when external users are accessing user records. External users can still see their own user records. This change doesn’t apply to queries running in System Mode.
Automatically Assign Records Created by Guest Users to a Default Owner (Previously Released Security Alert)
To increase the security of your Salesforce data, set up your org so that guest users are no longer automatically the owner of records they create. Instead, when a guest user creates a record, the record is assigned to a default active user in the org, who becomes the owner.
Opt Out of Enforcing Guest User Object Permission Changes (Update)
In Salesforce orgs created before Winter ’21, this update opts out your org from enforcing guest user object permission changes aimed at increasing your data security.
Opt Out of Guest User Security Policies Before Summer ’20 (Previously Released Update)
By activating this update, you opt out of three policies aimed at increasing your data security for guest, or unauthenticated, users. Activating this update opts your org out of having the following settings automatically enabled with the Summer ’20 release: Secure guest user record access, Assign new records created by guest users to the default owner, and Assign new records created by Salesforce Sites guest users. If your org already has these settings enabled, activating this update doesn’t change your configuration.
Guest Users Can’t Be Assigned as Owners of Already Existing Records
Before the Summer ’20 release, guest users couldn’t be assigned as owners of newly created records. Starting in Summer ’20, guest users can’t be assigned as owners of records already existing in the org.
Secure Guest Users’ Org-Wide Defaults and Sharing Model (Previously Released Security Alert, Enforced)
Learn about the Secure guest user record access setting in this security alert, and how to safeguard your org’s data. This setting enforces private org-wide defaults for guest users and restricts the sharing mechanisms that you can use to grant record access to guest users. If you have a Salesforce org created before Winter ’20, we recommend that you review the external org-wide defaults, public groups, queues, manual sharing, and Apex managed sharing that you use to grant access to guest users. Then replace the access previously granted by these sharing mechanisms with guest user sharing rules before the security alert is enforced.
Create Guest User Sharing Rules Before Enabling Secure Record Access
To help you prepare your Salesforce org for guest user security improvements, you can now create guest user sharing rules before you enable the Secure guest user record access setting. A guest user sharing rule is a type of criteria-based sharing rule that can grant Read Only access to guest users. When the Secure guest user record access setting is enabled, you can grant guest users access to records only through guest user sharing rules.
View All Users and Other Permissions Disabled in Guest User Profiles (Previously Released Security Alert, Enforced)
Guest users typically don’t need access to view all users in a Salesforce org, so to promote data security, we disabled the View All Users permission in guest user profiles. If you have a production org that was created before Winter ’20, we recommend that you check guest user access and deselect the View All Users permission in all your guest user profiles. To enhance security, we also removed these permissions from the guest user profile: Can Approve Feed Post and Comments, Enable UI Tier Architecture, Remove People from Direct Messages, View Topics, and Send Non-Commercial Email.
Modify All Data, View All Data, Edit, and Delete Permissions on Guest User Profiles in Orgs Created in Summer ’20
Orgs created in the Summer ’20 release don’t have Modify All Data, View All Data, or delete permissions on any standard or custom objects for guest user profiles. Guest users in orgs created in Summer ’20 still have edit permissions for custom objects and the following three standards objects: Order, Contract, and Survey Response.
Modify All Data, View All Data, Edit, and Delete Permissions on Guest User Profiles in Orgs Created Before Summer ’20
In orgs created before the Summer ’20 release, we're removing the View All Data, Modify All Data, and delete permissions on custom and standard objects for guest users, but only if they were never enabled on the guest profile or permission sets for guest users. In orgs created before the Summer ’20 release, guest user profiles retain guest edit permissions on all custom objects and the following standard objects: Order, Contract, and Survey Response. Guest users only had edit permissions on the three standard objects mentioned, and this behavior has not changed. If your org was created before the Summer ’20 release, and you have View All Data, Modify All Data, edit, or delete permissions on any object for a guest user, you’re notified by a Security Alert to make the necessary changes to your org.
Allow Guests to Safely Upload Files
Guest users may not have been able to upload files in public communities if the Secure guest user record access setting is enabled. To allow guest users to upload files to a record, developers can specify the fileFieldName and fileFieldValue attributes in lightning:fileUpload. The attributes are used to store a value in a custom field in the ContentVersion object.
Reduce Object Permissions for Guest Users by the Winter ’21 Release (Security Alert)
With the Winter '21 release, Salesforce is removing the View All Data, Modify All Data, and delete permissions for guest users, and they can never be used for guest users on any objects. If a custom or standard object has View All Data, Modify All Data, or delete permissions for guest users, all the permissions are turned off with the Winter ’21 release. Reduce object permissions for guest users if they have View All Data, Modify All Data, or delete permissions on a standard or custom object.
Opt Out of Turning Off Community-Specific Setting for Guest Users to See Other Members (Previously Released Update)
By activating this update, you opt out of turning off the community-specific Let guest users see other members of this community setting in the Winter ’21 release.
Ensure Guest User Access to Emails Created with Visualforce Email Templates
Protect access to your company’s data when you send emails that use Visualforce Classic email templates to guest users. Review and update these templates so that they can still be used.
Override Entity Permissions When Using <apex:inputField>
The new ignoreEditPermissionForRendering attribute on <apex:inputField> allows you to override entity edit permissions for users, even when the underlying permission on the object doesn’t allow edits. This override affects all users but is intended to be used only for guest users. This attribute works only with a custom controller in without sharing mode.

Guest User: Security Policies Enforced

See Also