---
schema_version: "1"
id: b176c047b91f5cef11dabdfbd8a52ed7a3d3a294579abd915cece7f6f09c92a0
title: Block Unauthorized Access to Orders
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/b2c_rn_order_allow_list.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.b2c_rn_order_allow_list.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4f3a9643b66758e33bd91be5d80febf7c969d11faaafe8cecc1222194fb3e3b4
description: The Order Preferences Storefront Order Access Allowlist, released in 24.5 in test mode, is fully functional and available to your storefront in Production. When enabled, storefront access to orders without a matching customer ID is now blocked unless the accessing controller is included on the Allowlist. If you aren’t yet limiting Storefront Order Access at all, enable the Allowlist feature on the Limit Storefront Order Access setting.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Block Unauthorized Access to Orders

The Order Preferences Storefront Order Access Allowlist, released in 24.5 in test mode, is fully functional and available to your storefront in Production. When enabled, storefront access to orders without a matching customer ID is now blocked unless the accessing controller is included on the Allowlist. If you aren’t yet limiting Storefront Order Access at all, enable the Allowlist feature on the Limit Storefront Order Access setting.

**When:** Starting with B2C Commerce 24.8 release.

**Why:** This feature enhances security, ensuring that the customer ID of the current session is identical with the customer ID used for the creation of the order being accessed.

**How:** In **Business Manager** | **Orders** | **Order Preferences**. Set the Limit Storefront Order Access dropdown to Allowlist. Enter the allowed storefront controllers as a comma-separated list. Attempts to fetch order information by controllers or hooks that aren’t on the Allowlist are blocked from storefront access, if the customer ID of the current session isn’t identical to the customer ID used for the creation of the order. Controllers and hooks not listed on the Allowlist are blocked from storefront order access. If you don’t change the Limit Storefront Order Access setting to Allowlist, you won’t experience any change from this feature.

#### See Also

- [Limit Storefront Order Access](https://help.salesforce.com/s/articleView?id=cc.b2c_limit_storefront_order_access_settings.htm&language=en_US)