Can I re-use a session ID outside of Salesforce?

Question

I have an app that lives outside of salesforce on my own servers. I am going to link to it from within a different app that is already in Salesforce. Ideally I don't want the user to have to login again.

Would it be possible to simply pass in the current user's session ID and server URL in the link via query params and re-use those params in my external app to populate my SforceSercive object?

E.g.

Link within Salesforce would be "https://myCustomApp.com?sessionId={currentUserSessionId}&serverURL={currentServerURL}

Then in my external app, parse those two params and populate my SforceService object like:

var client = new SforceService();    
client.Url = serverURL; //(from URL)    
client.SessionHeaderValue.sessionId = sessionId; //(from URL)

Or is the session ID specific to the domain it was created in?

Answer 1

In theory, you can. In practice, you should not. The ideal situation would be to use the appropriate API to get your own, separate session. You can use the Canvas API to get a session in a frame inside Salesforce, or you can use the OAuth 2.0 Web Server flow. Both methods can be configured for full, seamless integration, no login required. Keep in mind that if you decide to use the browser session, the Lightning Session ID will not be valid for API use, so you'd still need a separate token if you plan on doing anything useful.