Sample Code Without Sharing: Give Guest Users Access to Create Records and Update Them Later | Develop Secure Sites: Authenticated and Guest Users | Experience Cloud Developer Guide

These code samples support two separate interactions. In the first interaction, the guest user creates a case. For security reasons, an Apex method replaces the record ID with an encrypted string. When the guest user wants to close the case later, they enter that encrypted string. An Apex method decrypts the string to get the record ID, uses the record ID to select the case, and updates the case’s status.

This sample Aura component displays components for record creation and closure.

To create a case, the guest user uses components to enter case details. After record creation, lightning:card components display the new case’s encrypted token or the status of the case that matches the token.

For demonstration purposes, this sample displays a component where the guest user enters the case’s token directly. To implement this scenario, provide the guest user with a link that contains the token, and retrieve the token from the URL.

This sample JavaScript controller processes events for the Aura component and calls the methods in the helper file.

This JavaScript helper has two methods:

makeCase()

The makeCase() method creates an asynchronous request to create a case with the submitted data. When the request completes, the callback stores the new case’s unique token in the caseID field in a variable used by the Aura component.

updateCase()

The updateCase() method uses a token entered by the guest user to asynchronously update the case that matches the token. The method’s callback catches the response from the Apex method and stores the value in the case_status variable.

This sample Apex controller receives calls to create and update cases. It uses the User Encryption Decryption AppExchange package to encrypt and decrypt data.

CreateCase()

The CreateCase() Apex method creates a case with the guest user’s input. After record creation, it generates an encrypted string from the record ID, the record’s CreatedDate field, and the current timestamp. The Apex replaces the new case’s ID with the encrypted string.

UpdateCase()

The UpdateCase() method decrypts the provided string, validates the results, and uses the information to update the original record’s status. The response is the status of the record or an error message, if one occurred.

Define the class with the with sharing keyword because it doesn’t directly access the records.

Any system or individual on the internet can invoke @AuraEnabled classes. Make sure that the query can update only the correct record.

This sample Apex helper class defines methods that retrieve a record by its ID and update a record. The Apex controller calls this method.

Define the class with the without sharing keyword so that it can retrieve and update the record without requiring sharing.

See Also