Salesforce REST calls returning INVALID_SESSION_ID when we are in Lightning Mode

Question

I don't know how to explain this, but its totally weird and strange, Please take some time to read it.

Let's understand the flow here, Let's start with the flow first what we are actually doing there. we are having a third party app which is hosted on Azure and that third party have an exposed endpoint which calls our Salesforce API(my custom written API). Now this third party app call my SF custom API when I call one endpoint, the logic which reside on that particular endpoint internally calls my API.Now when I'm calling this third party endpoint API, I pass Salesforce authentication information like session id, instance URL and my service API URI, which can be used by the third party app to call my API.

So to summarize the workflow, I'm calling a third party endpoint with SF authentication info, and then that third party app calls my Salesforce custom API with that authentication info.

let's move further we are calling third party app from the Process builder invocable method, and invocable method calls a future method to do the third party API call. now as we know we couldn't get session id in future method so I'm generating session id in invocable method and passed it to future method as a parameter. now that session id along with other authentication info pass to the third party app by calling an endpoint, below the sample authentication request which we are sending to third party app.

{
   "authInfo" : {
                "instanceUrl" : "https://na30.salesforce.com",
                "serviceUri" : "/services/apexrest/MyCustomAPI",
                "sessionToken" : "<session_token>"
    }
}

So as per the flow, whenever process flow executed on update/create then our invocable method called and it will call that third party app, and then that app call back to our SF API with the authentication info which we sent with the API call request.

Now comes to the problem, this flow works great when we are in classic, but when we switch to the lightning, our API is not able to called from third party app. I started digging into that and print the entire request which we are sending to third party when doing callout. I manually called the API with the same auth request (token and url) in POSTMAN, and it failed and gives me INVALID_SESSION_ID error. Now it is not the case there like token is expired, the whole flow execute within 5 ~ 8 seconds.

I did some further digging and found that whenever we use a session Id which is generated in the invocable method and in lightning UI. then that session Id cannot be used with the API callout. to reproduce the error please print system.debug session token in invocable method and then use that session token to calls the SF API, remember you should be in Lightning UI.

I just wanted to confirm that Is it the bug in the Salesforce platform? or am doing something wrong over there.

EDIT

After Winter'18 release it is still not resolved. That mean this issue is not related to what Salesforce fix in winter'18, That's why opening the issue again.

Thanks

Answer 1

I raised the concern to Salesforce and it's categorized as a known bug, they are going to resolve it in Winter'18 release.

See below bug reference for more details:

Summer'17- Generating a Session Id from Lightning Domain Provides Invalid Session Id

Update [After Winter 18]

The issue is still there, had a case opened with Salesforce Support and it is verified that this is the documented limitation in lightning system, Refer below link: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/apex_api_calls.htm

Got following workaround from SF support (Which I was already using)
Getting Session ID in Lightning