6

I'm integrating with a 3rd party data provider.

The way their platform works is you must provide an endpoint to which they periodically send REST requests to with updated data etc.

They happen to send an 'Authorisation' header in the request with a value of:

Bearer [random_code]

The endpoint they're calling is hosted on a public Force.com Site, so there is no authentication to speak of. The problem I'm encountering is that Salesforce (I assume) is seeing this header and assuming it's a session ID which is then tries to log in with.

This is results of a 401 response with message:

[
    {
        "message": "Session expired or invalid",
        "errorCode": "INVALID_SESSION_ID"
    }
]

Is there anyway to strip this Authorisation header or otherwise make Salesforce ignore it?

Improve this question
1
  • That'd be a hard issue to solve if Salesforce is interpreting it as a sessionId. You might need to use a server in-between SFDC and your third party provider to proxy the request, strip out that header, and send it on to Salesforce.
    – Derek F
    Commented Jun 28, 2018 at 18:08

1 Answer 1

Reset to default
2

You definitely can't control it from Salesforce's end; Salesforce checks authentication very early in the stack process, before any code you could possibly write could run. Your ideal situation would be to configure the third party system to not do this. Otherwise, you could also use an ESB (Enterprise Server Bus) to strip out the header (at least, any reasonable ESB can do this). As a very not-ideal situation, you could put a server between the third party and Salesforce. You'd have to write some code in PHP/Perl/Python/Node/etc to accept the incoming connection and then connect to Salesforce.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .