Iam trying to query records using AJAX Toolkit Javascript API through force.com sites.
But sforce.connection.query not working through sites. The same code working for internal users.
Please find the code snippet below:
function EditRecord(contid) {
alert('Contact Id::'+contid);
sforce.connection.sessionId = "{!$Api.Session_ID}";
var result = sforce.connection.query("SELECT Id,FirstName,LastName,Email,Phone FROM Contact where Id='" + contid+ "'");
alert('result::'+result);
}
Can any one help me on how to access this without sessionId and force.com sites.
Best Answer
This got pushed back up to the home page two years later but... yeah totally not happening. Think about the security implications. You'd have to have a session ID with API access for an unauthenticated guest user, and then anyone malicious would simply be able to type their own query into JavaScript console and search for whatever they want. Any objects they have write access to, they'd be able to just go nuts. If you had to make a certain object readable/writable to accomplish your use case, having a working unauthenticated API would be disastrous.
On the other hand Visualforce Remoting and Visualforce Remote Objects should work fine. But remember that anything you make available in JS can potentially be used maliciously by users so you need to ensure that the server side is not exposing anything that can be abused.