I created a force.com Site, which uses a LWC in Visualforce page. It seems that the Guest User cannot read the records and even if I preview as admin the Site still the records are not showing. Guest User has access to the objects, the visualforce page and the Apex class controller. Is there any permission I need to add? TIA.
[SalesForce] Guest User cannot access @AuraEnabled Apex Controller
Related Solutions
I feel your pain, according to the new Guest User security, there's a lot less one can do through UI now, here's a good summary: https://help.salesforce.com/articleView?id=networks_guest_policies_timelines.htm&type=5
For external user to View a record, you need to add a sharing rule, which has a new option now: Guest user access, based on criteria
*Note that Guest user can no longer be owner of any records, so you can set your sharing rule to "Created By", or something else other than Owner Id.And if you want to Edit / Delete record, it would have to be apex, (without sharing) https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm , which runs in system context.
Also, an alternative method: Flow(Without Sharing) is mentioned here: https://www.isimio.com/2020/08/07/migrating-to-salesforce-secure-site-guest-user/
Best Answer
There is a critical update called "Restrict Access to @AuraEnabled Apex Methods for Guest and Portal Users Based on User Profile".If you have this critical update enabled in your org then the guest users will not be able to access the @AuraEnabled apex classes unless you give the access on profile level.
Please refer the release notes to see the same for more information.