5

I've got a telemetry application for which the Streaming API would be extremely useful. However I want the subscriptions to be publicly accessible. (So that anyone with the client can waltz up and consume.)

Is it possible to use the Streaming API via a Force.com Site? Without baking passwords into my code?

Improve this question

3 Answers 3

Reset to default
5

Several potential issues that lead me to believe the answer is no:

  • not 100% but pretty sure public sites user cannot authenticate via OAuth (you can't "sign in" as guest in other, more traditional ways - it's a magic user). Even if they can, you'd want to validate that the Streaming API is available to the guest profile (which I doubt). Could not find any documentation on either of these points but I'd be surprised if you could do either of them.
  • so assuming that's true, your option would be secure authentication as someone other than Guest.
  • if you were able to bake an authentication token into client-side JS code for someone other than Guest, it would be a potential security hole.
  • it would also likely violate Force.com Sites terms and conditions, since they would technically be authenticated users at that point and you would be sharing them among all public users.
  • even if you could do these things securely and legally, you'd be severely limited by the Streaming API limits. The PM team claims they will raise those limits on request, but out of the box it is a ridiculously low 20 clients for EE, 100 for UE, 10 for other. I would not want to be subject to Salesforce raising my limits now but being free at any time in the future to lock them back down on a whim or try to charge me. This is a fatal flaw in how Streaming API was deployed, IMO. The limits should be much higher than polling mechanisms, since they should be so much more efficient. But they're not.

You can accomplish almost as good as Streaming with an AJAX polling mechanism to a public VF page serving some basic REST-type/JSON/XML data service. It's less efficient and a little more laggish, and will hit your API/request quota, but for now it is a better option IMO than the Streaming API.

Improve this answer
0
5

Supported or not :-/ I may have found a way - here's what I did:

  1. created a Force.com Site,

  2. saved a Session.page containing the following:

    <apex:page contentType="text/plain">{!GETSESSIONID()}</apex:page>

  3. edited the list of Site Visualforce Pages on the Site to include it,

  4. viewed the page at the Secure Web Address (mysite.secure.force.com/Session)

session id

This (apparently) yields the Site Guest User's current Session ID. Taking the string and placing it in the Authorization: OAuth ... header works when subscribing to a topic at /cometd/27.0.

Edit: more testing needed...

Improve this answer
4
  • 12345? That almost sounds like a fake orgId on your sessionId!
    – ca_peterson
    Commented Apr 17, 2013 at 4:55
  • @ca_peterson anonymized by me (using inspector) prior to screenshotting
    – Matt and Neil
    Commented Apr 17, 2013 at 7:04
  • The initial connection works, the page sends periodic polls to the back end, but I don't see any updates coming back.
    – metadaddy
    Commented Aug 22, 2014 at 22:12
  • This stopped working after summer 2020, now you will always get null session-id for guest users.
    – Rahul Gawale
    Commented Oct 1, 2020 at 11:11
2

streaming api does not expose pushtopics to a guest user .so that we cant get updates on site from streaming api.

Improve this answer
2
  • 1
    are you saying that the streaming API can not be made publicly accessible?
    – Matt Lacey ♦
    Commented Jun 19, 2013 at 1:27
  • this is correct, and the behaviour reflects the same :(
    – Matt and Neil
    Commented Jul 9, 2013 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .