What could be causing a user to have to login twice to the customer portal?

Question

Question

Has anyone encountered issues with portal users suddenly being asked to login again to the customer portal when accessing Visualforce resources? Any ideas what could be done to fix it?

Background

We have a customer portal with some helper buttons that are implemented in Visualforce and then displayed to the user via an iframe in a custom sidebar component. For some users, using the buttons in the sidebar component takes them back to the login page. Based on the startURL param from the login page the referring page was /visualforce/session?url=https%3A%2F%2Fc.na1.visual.force.com%2Fapex%2FMyVfPage.

It would appear the sequence is

1. Login to the Portal land on home page

   https://na1.salesforce.com/home/home.jsp

2. Click Over to a Visualforce Page

   https://c.na1.salesforce.com/apex/MyVFPage

3. Get redirected to /visualforce/session

   /visualforce/session?url=https%3A%2F%2Fc.na1.visual.force.com%2Fapex%2FMyVfPage

4. Kicked out to login page

   https://login.salesforce.com/?ec=302&startURL=%2Fvisualforce%2Fsession%3Furl%3Dhttps%253A%252F%252Fc.na1.visual.force.com%252Fapex%252FMyVfPage

Answer 1

And the answer was!!

Internet Explore security settings.

Turns out the particular user had some fairly restrictive security settings for untrusted sites. They had whitelisted *.salesforce.com but not *.force.com. Add *.force.com to their list of trusted sites fixed the issue.

Answer 2

As far as I know, cookies are managed per domain. Since na1.salesforce.com and c.na1.visual.force.com are two different domain, this may be the reason why the user has to login twice (two domains, two cookies).

If you give additional details about how your Visualforce pages are setup, I might be able to pinpoint the source :)!