2

Since a few weeks all of the Salesforce urls that are shown in our external web application redirect to the Salesforce login page, even if the user is already logged in into Salesforce.

The URLs that are shown in the application look like this:

https://domain.eu1.visual.force.com/apex/Opportunity?id=xxx

When clicking the url the users are redirected to:

https://login.salesforce.com/?ec=302&startURL=%2Fvisualforce%2Fsession%3Furl%3Dhttps%253A%252F%252Fdomain.eu1.visual.force.com%252Fapex%252FOpportunity%253Fid%253Dxxxx

Could this be a security setting of some sort?

Edit

If I copy-paste the same url directly into the browser, I don't get the login page

SOLVED

Issue found! Apparently our client changed servers/domain. The old domain was:

domain--c.eu1.visual.force.com

The new one:

domain--c.eu4.visual.force.com

This is why we got redirected

  • Does the Opportunity page actually use a StandardContorller? See this thread which may be relevant. – Adrian Larson Jul 25 '16 at 21:11
1

Your redirect URL looks a bit odd. If I decode the query string I get:

  • ec=302
  • startURL=/visualforce/session?url=https%3A%2F%2Fdomain.eu1.visual.force.com%2Fapex%2FOpportunity%3Fid%3Dxxxx

It's like you are bouncing the request through /visualforce/session?. Why not just set the startURL directly to /apex/Opportunity?id=xxx?

Note that the startURL must be a relative URL.

For example, if I want the user to end up at:

https://dfb.na5.visual.force.com/apex/HelloMobile?sfdc.tabName=01r70000000UJnp

I send the browser to:

https://login.salesforce.com/?startURL=%2Fapex%2FHelloMobile%3Fsfdc.tabName%3D01r70000000UJnp

Note that I don't define the domain that the user will be logging into. Just the relative URL encoded for the query string.


If your external web application already has a valid Session then you could use the frontdoor.jsp to directly bypass the login page.

  • People don't login into SalesForce in the application. The application syncs data from SalesForce and this is displayed in the app. Then when someone clicks a url that links to a salesforce opportunity, it should open the SalesForce page in a new tab. This has worked before but since a few weeks it stopped working like this. – nickv Jul 26 '16 at 7:39
  • also, the app does not bounce the request through /visualforce/session? it is something that SalesForce does automatically. This is the html that is used in the app <a target="_blank" href="https://domain.eu1.visual.force.com/apex/Opportunity?id=xxx">OPP-123456</a> when a user clicks this url, it gets redirected to the login page. When you copy-paste the url directly in the browser bar, you don't get redirected. Looks like a referral restriction of some sort – nickv Jul 26 '16 at 7:49
  • @NickVerbaendert I just did a test by defining the startURL query string parameter as a relative URL and it seemed to work fine. I think there are a couple of important differences. 1) I used login.salesforce.com rather than domain.eu1.visual.force.com. Salesforce can figure this out when the user logs in. 2) I explicitly defined the startURL rather then trying to go directly to the target URL. – Daniel Ballinger Jul 26 '16 at 22:59
  • Thanks, I did the same test but now users will still need to re-login even though they are already logged in into SalesForce. Why is it exactly that when a user clicks on a SalesForce url in a browser he needs to re-login and when he just copy-pastes the url in the browser bar he goes directly to the correct page? fyi: I have the same issue when I send the url to someone in eg. Facebook chat, but not if I send it through Slack. So it is really browser related I guess. – nickv Jul 27 '16 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.