Since a few weeks all of the Salesforce urls that are shown in our external web application redirect to the Salesforce login page, even if the user is already logged in into Salesforce.

The URLs that are shown in the application look like this:


When clicking the url the users are redirected to:


Could this be a security setting of some sort?


If I copy-paste the same url directly into the browser, I don't get the login page


Issue found! Apparently our client changed servers/domain. The old domain was:


The new one:


This is why we got redirected

  • Does the Opportunity page actually use a StandardContorller? See this thread which may be relevant.
    – Adrian Larson
    Jul 25, 2016 at 21:11

1 Answer 1


Your redirect URL looks a bit odd. If I decode the query string I get:

  • ec=302
  • startURL=/visualforce/session?url=https%3A%2F%2Fdomain.eu1.visual.force.com%2Fapex%2FOpportunity%3Fid%3Dxxxx

It's like you are bouncing the request through /visualforce/session?. Why not just set the startURL directly to /apex/Opportunity?id=xxx?

Note that the startURL must be a relative URL.

For example, if I want the user to end up at:


I send the browser to:


Note that I don't define the domain that the user will be logging into. Just the relative URL encoded for the query string.

If your external web application already has a valid Session then you could use the frontdoor.jsp to directly bypass the login page.

  • People don't login into SalesForce in the application. The application syncs data from SalesForce and this is displayed in the app. Then when someone clicks a url that links to a salesforce opportunity, it should open the SalesForce page in a new tab. This has worked before but since a few weeks it stopped working like this.
    – nickv
    Jul 26, 2016 at 7:39
  • also, the app does not bounce the request through /visualforce/session? it is something that SalesForce does automatically. This is the html that is used in the app <a target="_blank" href="https://domain.eu1.visual.force.com/apex/Opportunity?id=xxx">OPP-123456</a> when a user clicks this url, it gets redirected to the login page. When you copy-paste the url directly in the browser bar, you don't get redirected. Looks like a referral restriction of some sort
    – nickv
    Jul 26, 2016 at 7:49
  • @NickVerbaendert I just did a test by defining the startURL query string parameter as a relative URL and it seemed to work fine. I think there are a couple of important differences. 1) I used login.salesforce.com rather than domain.eu1.visual.force.com. Salesforce can figure this out when the user logs in. 2) I explicitly defined the startURL rather then trying to go directly to the target URL. Jul 26, 2016 at 22:59
  • Thanks, I did the same test but now users will still need to re-login even though they are already logged in into SalesForce. Why is it exactly that when a user clicks on a SalesForce url in a browser he needs to re-login and when he just copy-pastes the url in the browser bar he goes directly to the correct page? fyi: I have the same issue when I send the url to someone in eg. Facebook chat, but not if I send it through Slack. So it is really browser related I guess.
    – nickv
    Jul 27, 2016 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .