We recently launched a mobile app and we use Salesforce Identity Management. ie all customers have a Salesforce user record and authentication is done is Salesforce. After the launch, some users were saying that they encountered issues when they tried to log in to the app - issues like blank screen with yellow bar at the top or login button that never lit up to be able to click on etc etc. These are issues that we are unable to reproduce by the way.

So we ran a report and found that some users were having issues logging in (report filter is Status not equal to Success). We then drilled down to their login history, we see that they seemed to have logged in successfully through the app then immediately followed by an error 'Invalid Nonce'. See screenshot below.

enter image description here

Has anyone see this 'Invalid Nonce' error before? What does it mean?


Basically, this error is saying that Salesforce has detected a "replay attack" scenario. A nonce is a random, unique value generated for each login attempt in certain login flows. If the same nonce is presented more than once, this security measure blocks the login attempt. The most likely scenario in your case is a logic bug in your code, possibly because of an interrupted connection attempt, where the app tries to reuse the previously acquired nonce instead of starting the flow over again. Your only real choice here is to attempt to login from the beginning again. I suspect this will mean modifying your mobile app's code to detect this situation and restart the flow. Once granted access by the server, retried attempts should be transparent to the user.

| improve this answer | |
  • Hi sfdcfox, thanks for your reply. I will run this past the app developer. – Vei Chong May 10 '19 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.