I have a requirement to call REST API from Salesforce lightning component, for that i need to have session id of that user while requesting a REST service. But, in current version (Summer 18) of Salesforce the session id i'm getting from UserInfo is always Invalid, that means salesforce doesn't give session id in Summer 18 release. Is there any alternative to get session Id in Summer18?

  • Is their a reason for not doing the REST API calls from the Apex Controller?
    – John
    Sep 21, 2018 at 17:39
  • @Suneel K, Did you find answer to this problem. I cannot get session id in lightning cmp as well and the visualforce workaround do not work in managed packaged (THrows org.apache.commons.httpclient.RedirectException: Maximum redirects (100) exceeded) error.
    – lambad
    Jun 19, 2019 at 11:38

2 Answers 2


Take a look into the document mentioned here .You cannot use the session obtained from userinfo to make REST API calls using the @AuraEnabled methods for Security reasons .

Salesforce recommends creating a Named Credential inorder to use this and by pass security if your application badly needs it .

If you want to understand the steps needed to set Named Credentials then follow the article here

The other approach could to be use a Visualforce page that has a sessionId and use PageReference method to access the sessionId.

<apex:page >

public class LighntingController {

  public static String getUserSessionId(){
     String sessionId = '';
    // Refer to the Page
    PageReference reportPage = Page.GetSessionIdVF;
    // Get the content of the VF page
    String vfContent = reportPage.getContent().toString();
    System.debug('vfContent '+vfContent);
    // Find the position of Start_Of_Session_Id and End_Of_Session_Id
    Integer startP = vfContent.indexOf('Start_Of_Session_Id') + 'Start_Of_Session_Id'.length(),
    endP = vfContent.indexOf('End_Of_Session_Id');
    // Get the Session Id
    sessionId = vfContent.substring(startP, endP);
    System.debug('sessionId '+sessionId);
    // Return Session Id
    return sessionId;

public static String makeAPICall(){
    String sessionId = getUserSessionId();
     HTTP h = new HTTP();
     HTTPRequest req = new HTTPRequest();
     HttpResponse resp = new HttpResponse();
     req.setHeader('Authorization', 'Bearer ' + sessionId);
     resp = h.send(req);
     System.debug('#### Response Status '+resp.getStatus());
     System.debug('#### Response Status Code '+resp.getStatusCOde());
     return JSON.serialize(resp.getBody());
  • Hi Mohith, Thanks for your quick response. Is there any way other than using Named credentials or Visualforce page ? Named Credentials are domain specific, if I install my app in other domain then Named Credentials won't work. And I think using Visualfoce page is also a temporary fix for this.
    – Suneel K
    Jul 4, 2018 at 9:28

Note that if your Lightning Component is in a Flow Screen, you can retrieve the SessionId using a Flow formula with $Api.Session_ID and then pass it into the lightning component.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .