8

I have a requirement to make a call to the Apex Wrapper Metadata API from a Lightning component. The issue I am facing is that there is currently no native support for acquiring a valid API session ID from an @AuraEnabled method in a Lightning component Apex controller.

The Lightning developer documentation states that a named credential can be used in order to bypass this security restriction. However, when I set up a named credential and then pass that named credential reference as the endpoint for the Metadata Service API, I am receiving the following error:

"FATAL_ERROR System.CalloutException: Web service callout failed: WebService returned a SOAP Fault: INVALID_SESSION_ID: This session is not valid for use with the API faultcode=sf:INVALID_SESSION_ID faultactor=".

I have found a potential work around using Visualforce. However, the thread presenting this work around does not reference the "Named Credentials" feature as an option.

This post also presents the same issue where the documented named credential stops have been followed and the same error is received, but no solution has yet been offered.

I am not able to understand why the named credential feature is not bypassing the session id security measure for Lightning components.

Any input would be greatly appreciated.

5

You have to manually replace the Session ID in your request body/header .

In named credentials we have options to use the Merge fields in header/body enter image description here

 @AuraEnabled
public static String getOrgLimits(){
    HTTP http=new HTTP();
    HTTPRequest hres=new HTTPRequest();
    hres.setEndpoint('callout:OWNINSTANCE'+'/services/data/v39.0/limits');
    hres.setMethod('GET');

    hres.setHeader('Authorization','Bearer {!$Credential.OAuthToken}');//Magic happens here
    HttpResponse response=http.send(hres);
    System.debug(response.getBody());
    return response.getBody();

}

In the above example I am trying to hit my own org's REST endpoint to get LIMITS of my current org. Its native REST calls without using SESSION ID.

In case of SOAP callout you can code something like

public class EchoManager {
    public String endpoint_x = 'callout:Echo_Service';
    . . .
    public String echo(String text) {
        WSEchoManager.echo_element request_x = new WSEchoManager.echo_element();
        request_x.text = text;
        this.SessionHeader = new SessionHeader_element();
        this.SessionHeader.sessionId = '{!$Credential.OAuthToken}';//Magic happens here 

You have to use merge field header for Rest Call where as you have to use Merge field Body in SOAP call.

You can read more about merge fields here https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_merge_fields.htm

https://blog.enree.co/2016/03/salesforce-apex-lets-play-with-named.html

  • cheers ,good day :) – Pranay Jaiswal Jul 11 '17 at 18:26
  • @PranayJaiswal Is this solution still working? – Praveen Sep 28 '18 at 17:05
  • @Praveen yes it is – Pranay Jaiswal Sep 28 '18 at 17:20
  • Can you confirm that this method only works if you have hardcoded a user as the NamedPrincipal in the named credential callout? What I'm asking is can I use this to dynamically get the user session id from the currently logged in user in Apex? – Etienne Rocheleau Feb 4 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.