I've connected to Salesforce via REST and am querying the photoURL field of the contact record. I get back something like this for the photoURL /services/images/photo/0030N000024o75dQAA
On the client side, which is a web application, I add that value to the org instance URL and get https://eu8.salesforce.com/services/images/photo/0030N000024o75dQAA
We use that in an image tag on the web page and it redirects the image to the social media site: https://pbs.twimg.com/profile_images/479287176824233984/jxCcTken_bigger.jpeg
To put it another way
will 302 redirect the image to that from twitter.
All great IF you are logged into Salesforce in the browser. As the information is being accessed via REST from an external webpage to Salesforce then this is not going to always be the case. I.e.
<img src="https://eu8.salesforce.com/services/images/photo/0030N000024o75dQAA"/> will be rejected by Salesforce as you're not logged in in the browser.
I did find an interesting solution where if I put an query string attribute of oauth_token with the call to API call to Salesforce
then Salesforce let's it in and sends back the 302 redirect and the browser displays the twitter image. I was happy.
However Salesforce's Enterprise Security team did a review on the application and they asked for this to be removed.
So, my question. Given an application running in a browser that uses REST/OAuth2 to communicate with Salesforce how do I get it to render the social media images associated with a contact when the browser is not logged into Salesforce and Salesforce security reject the ?oauth_token approach?