+ Start a Discussion
King KooKing Koo 

Do I need to add controller/extension to profile/permission set if I already add Visualforce?

Hi there

In the past whenever I add a VF to a profile or a permission set, I always also add the associated controller or controller extension to the same profile and permission set.

This morning (22 May 2015) I omitted to add the controller for my VF page to the profile, but I found out the VF page still renders for the profile I was testing.

Am I missing something here?  Or is it something new?


James LoghryJames Loghry
Nothing you're missing.  I tend to do the same (add both the Apex and VF page to the profile), but as long as you add the Visualforce page, it will be able to call the controller / any associated apex as well.

You do not need to add the corresponding Controller/Extension class to the profile. Only permission to VF will be sufficient to render the page. 
However if you have any global/webservice method in a class and you want your users to be able execute them (other than from VF), you need to provide them access to that class.

King KooKing Koo
Hi James

Thanks for your quick reply...  Have to admit I was quite shocked at this discovery this morning.  I'm guessing only when you're invoking some apex classes as top-level invocations do you need to add the Apex classes to the profiles then - not through VF, not through triggers, right?
Giving page access works fine as long as your page doesnt have a custom component with its own controller. if you have custom componet in your page you have to explictly give acess to custom component's controller class