No rule selected
A-1340 – Avoid pages without an authorization scheme.
Every page that requires authentication should also declare an **authorization scheme**. Authentication only proves *who* a user is; authorization decides *what* they are allowed to reach. Without an authorization scheme, any authenticated user can open the page, a common cause of broken access control. If this is intended, use the `mustNotBePublicUser` authorization scheme. Set an authorization scheme on the page under **Security → Authorization Scheme**. Pages that are intentionally public (login, home) are exempt and are already excluded by the check.
Tags: All APEX versions, APEX_APPLICATION_PAGES.
Quality area: Security. Severity: Critical. Fixing time: Local-easy.
Press p or n to quickly navigate to the previous/next rule.