3

I need to enable access to private VisualForce pages from an external connected app using only the access token obtained via OAuth process. I have followed what is described in this SF blog here without success. What I did was the following

However, the system logged me out every time.

I looked at this other SF forum post that referenced a similar issue and the answer given was to use Site, which is a type of public VF page. I need to access private VF pages so that solution is not applicable to my case.

If anyone has any suggestion to this, it would be much appreciated. Thanks.

Improve this question
2

I tried this out in a developer edition org.

  1. Confirm Visualforce page URL by directly accessing URL: https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage. Note that I have a namespace prefix defined in this org in addition to a "My Domain" of thepackage-dev-ed
  2. Tested in an anonymous Chrome window with no URL parameters. Redirected to login page as expected.
  3. Tested in an anonymous Chrome window with ?oauth_token=<Session ID from sid cookie>. Visualforce page displayed
  4. Tested in an anonymous Chrome windows with ?oauth_token=<Session ID from sid cookie in force.com domain>. Redirected to login page. Expected as the session id from that context is limited.
  5. Tested in an anonymous Chrome windows with ?oauth_token=<access_token form OAuth connected app with full scope>. Worked.

So, double check if the Visualforce page URL requires the My Domain changes. Also try with some different classes of Session ID to narrow down if it is just the access_token causing the problem.

To reproduce case 3:

  • open Salesforce to /home/home.jsp.
  • Bring up the Chrome Developer tools
  • Application tab
  • Find Cookies under storage
  • Copy the session ID out of the sid cookie. Either the one that is bound to your domain (e.g. na64) or the my domain one.

Getting the Salesforce Session ID sid cookie

Revisited

  1. Got a session ID from the SOAP API so I'd have no active browser based Salesforce login.
  2. Tried browsing to https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage - Got redirect to the login page.
  3. Tried browsing to https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage?oauth_token= - Visualforce page displayed directly. Note any attempt to load a different page came up with the login page.
  4. Tried the URL from (3) in Firefox, got bounced around and auto logged out.
  5. Tried the URL from (3) in Edge, got bounced around and auto logged out.
  6. Cleared the cookies from Chrome. Got the same results as Firefox and Edge.

So there is some extra cookie that is required in the process.

There were a number of cookies from login.salesforce.com and thepackage-dev-ed--abc.na62.visual.force.com that might have been at play here.

I believe it is one of the non-session persisted visual.force.com cookies that is important here. Try:

  1. Logging into Salesforce.
  2. Viewing the Visualforce page (sets the required cookies)
  3. Logging out of Salesforce
  4. Accessing the Visualforce page with the oauth_token URL param and otherwise no active browser session.

I found this works. Isolating which of those cookies is required would take some laborious trial and error.

Improve this answer
  • Thanks for looking at this. I tried out the above scenarios, but none of them worked. Can you please show how you obtained the sessionId or access token in each case? Maybe that's where I got things wrong. – hoangmphung Jan 15 '18 at 0:55
  • What I did to get the sessionId / access token: * Session Id from sid cookie: Log into SF, open dev console, Application tab, Cookie session. There are sid cookies for both salesforce.com and force.com domains and they are identical. * access_token: Comes from my connected app with full scope setting. BTW, I did add the namespace prefix to the VF url. – hoangmphung Jan 15 '18 at 1:08
  • @hoangmphung I'm surprised that the force.com sid cookie is the same. There should be Different Session Ids in Different contexts. You should see this in the Admin Session management page in the Session Type column. – Daniel Ballinger Jan 15 '18 at 1:17
  • Sorry, I checked again and the sid cookies are indeed different. However, I tried both of them and neither worked. Can you try it in a different browser? Anonymous browser windows share data so it might come from a logged in session you had earlier. – hoangmphung Jan 15 '18 at 1:30
  • @hoangmphung Odd, it doesn't seem to be working now and is bouncing me through a logout process. It may be that I had some inadvertent cookies still hanging around in my incognito window. What is odd is that the way it redirects the request is different if you use a valid Session ID. So it is doing something with it. You might need to raise a support case to find out why it is no longer working. – Daniel Ballinger Jan 15 '18 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.