I am using the forcetk proxy so that I can send AJAX requests and not have to worry about the cross domain restrictions.

The sequence is:

But I can't. So I go thru the popular forcetk proxy which sends request to:


with the header:

Saleforce endpoing: na9.salesforce.com/services/data/v20.0/query/?q=SELECT+Id,Name,FirstName,LastName+FROM+User+WHERE+Id+IN+BLAH+BLAH ...

All super. However, if the session has timed out a 302 is returned. I see this in fiddler. The location header is back to salesforce page.

Location: https://na9.salesforce.com/visualforce/s...

This is fair enough. Salesforce is trying to redirect you to the login page because your login has timed out.

However, this HTTP response is never returned to the actual page. It looks like both IE and firefox detect that this is a cross domain restriction threat. Why? Because the original page that made the ajax request is in a different domain. This is fair enough. Why should a browser let a redirected ajax request go to another domain? This is a violation of cross domain restrictions.

Now, forcetk makes cross domain requests possible for ajax requests in the first place. But it does not seem to be able to handle redirects that go to the same domain the service endpoint is actually on. I am wondering is there any way it could be expanded or if there is anything I could do to be able to get around this?

Currently, if you are using forcetk you can't really deal with with AJAX requests when your session times out.

  • Have you set sesion id on your VF page?
    – doga
    Apr 25, 2013 at 10:31

1 Answer 1


How you handle the timed out Visualforce session depends on how you are getting the session id. If you are using OAuth, you refresh the session token, then refresh the Visualforce session, then retry your API call using forcetk.

Using the OAuth plugin from the Mobile SDK, refreshing the session token will update the sid cookie on .salesforce.com. You can then access a VisualForce page at https://na9.salesforce.com/myapp__Session, for example, using jsonp. After a number of redirects, you'll end up with a valid session id set on myapp.na9.visual.force.com. Then you can call the API through the proxy.

If you're getting your session id from Visualforce after the user has authenticated through the browser, all you can do is detect the failed API call, and redirect the user to log back in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .