I've got a native iOS app that uses a WKWebView to display a Visualforce page. This page makes extensive use of remoting, and currently I'm trying to determine a strategy to deal with session timeouts: I want to be able to refresh the session without having to reload the page.

The Salesforce docs detail this process for hybrid apps:

// Refresh oauth token
    function(creds) {
        // Reload hidden iframe that points to a blank page to
        // to refresh Visualforce domain cookies
        var iframe = document.getElementById("blankIframeId");
        iframe.src = src;

        // Refresh CSRF cookie
        // Get the provider array
        var providers = Visualforce.remoting.Manager.providers;
        // Get the last provider in the arrays (usually only one)
        var provider = Visualforce.remoting.last;
        provider.refresh(function() {
            //Retry call for a seamless user experience

    function(error) {
        console.log("Refresh failed");

So far I've got the refresh token being used to reauthenticate the session in the native code being triggered by Javscript, and I've got the resulting data structure coming back to a Javascript function—it's identical to that provided by the cordova plugin to the creds parameter in the snippet above.

What I want to know is how I go about using and applying this new session information. Presumably the cordova plugin does something sneaky and writes taht info somewhere, because the creds argument is not being used in the code above.

When I call provider.refresh() it seems to be trying to redirect to the Salesforce login page which is clearly not what I want.

What do I need to update to allow remoting calls to work with the new session information and avoid disrupting the user?


Not long after posting this I stumbled across a page in the documentation called OAuth 2.0 Authentication for JavaScript Remoting, that includes this little gem:

Configuring OAuth for JavaScript remoting from a Visualforce page takes the following form:

  <script type="text/javascript">
      Visualforce.remoting.oauthAccessToken = <access_token>;
      // ...

Once oauthAccessToken is set, all JavaScript remoting requests use OAuth. The rest of your JavaScript remoting code can remain the same.

This worked a treat, so I could remove the nasty iFrame hack, ignore the providers, and simply do this:

    function updateAuthentication(creds)
        Visualforce.remoting.oauthAccessToken = creds.accessToken;

Once that has been invoked from the native side of the app all the remoting calls start working as expected!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.