I have implemented most of the Salesforce OAuth process (Web Server Flow outlined here) using a VF page to initiate the process.

  • The VF page uses javascript in a command button to open a popup
  • User is presented with the 'Allow Access' screen and clicks 'Allow'
  • a token is successfully sent to our callback url
  • we are able to obtain the access token and refresh token at our site backend
  • the url for the popup ends on https://{instanceurl}/_ui/identity/oauth/ui/AuthorizationPage

The issue we have is the last item after everything has completed, that popup goes blank and we can't seem to access it to either (1) close it, or (2) redirect it away from /_ui/identity/oauth/ui/AuthorizationPage

VF Page:

<apex:page showHeader="false" showChat="false" sidebar="false" >
<script type="text/javascript">

    var url = 'https://login.salesforce.com/services/oauth2/authorize?response_type=code' +

    function openAuth() {
        console.log('Opening Popup');
        var win = window.open(url, 'Connect', 'height=524,width=675,toolbar=0,scrollbars=0,status=0,resizable=0,location=0,menuBar=0').focus();       

    <apex:form >  
        <apex:Messages />
        <apex:commandButton value="JS Connect" onclick="openAuth()" rerender="none" style="background:#D3D3D3;width:150px;" />     

So the question here is: Once the OAuth flow has completed, how do we (1) redirect the user back to a page in Salesforce, or (2) close the popup? Or have I missed a step in the process completely?

I have tried to access the popup with win.location.href and win.document.body but always get an error like "Uncaught TypeError: Cannot read property 'location' of undefined"

  • Does the oauth have to be invoked using a button? Can't you do it using a PageReference and redirect? Also if using this, can you try win.close() perhaps after a timeout in your openAuth() function. – Richard N Jun 15 '17 at 8:42
  • Tried using a PageReference but it still went dead at that 'interim' url - /AuthorizationPage. It might be worth mentioning that the callback url we use isn't accessible in a browser, its really just an API endpoint that receives the token. i.e. - it shouldn't really be called by a browser window. Could that be part of the issue? – Greg J Jun 15 '17 at 11:21

Think I solved it. Our web api wasn't returning anything at all. I assumed Salesforce would handle the redirect after completion. Instead, our auth web api now returns a HttpResponseMessage, but only once we have validated the access token and refresh token. It looks a little like this:

public async Task<HttpResponseMessage> InitialAuthentication(string code)
    //receive the initial token 
    //return it for an access and refresh token and user instance url

    //once Oauth process completes return a HttpResponseMessage
    //setting the location as the user instanceURL processed above in the OAuth functions
    //Could also append a specific VF success page or modify the InstanceURL as needed to show a success page

    HttpResponseMessage response = Request.CreateResponse(HttpStatusCode.Moved);
    response.Headers.Location = new Uri(newUser.InstanceURL);
    return response;
| improve this answer | |
  • Hi Greg:: COuld you post your code please? – PSH Jan 19 '18 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.