1

I am trying to read the user session using GETSESSIONID() on the VF page and using UserInfo.getSessionId() in apex. The values returned by both ways do not match.

GETSESSIONID() => 00DAB000000I1zO!AQoAQJ3Ou27E7EonznDKcQa5dKfJtAYutaiUPwfNuG4_KnfMupjd22EAmGo4obWr9NMFVIgKtGvjF8Cnb_WmMBE4pPC2CbVC
UserInfo.getSessionId() => 00ABf000000I1zO!AQoAQByH38YFB62y0cS.jATTFTi4WX4sIzAZZp_UR.QLi9SZ2la1NPrLkuJtxemKOc3HhpQRwGUhPqoQMulDGXPlXnNZZZ2q

Why sessionId value is different on the VF page and Apex controller?

2
  • 1
    P.S. make sure you log out of those sessions, as they are as valuable as passwords...
    – sfdcfox
    Feb 15, 2022 at 19:44
  • I have changed the session values before posting here Feb 15, 2022 at 20:59

1 Answer 1

5

Salesforce has multiple domains, such as visual.force.com, lightning.com, org.my.salesforce.com, etc. When you log in, a parent session is created; depending on how you log in, you'll get a different type of Session Id. If the parent Session Id is logged out, all other sessions are also logged out at the same time. When you use Apex, you will get one of several different Session Id values, depending on where the Apex was called from. When you call GETSESSIONID, it should be a Visualforce Session Id. All of those Session IDs are valid, but generated from different contexts.

4
  • Is there way to retrieve parent session, or any other value which is unique to Salesforce user session and has value same in VF page and apex controller? I am trying implement Salesforce session token and which will be validated before action executes. Feb 15, 2022 at 20:50
  • @SatishakumarAwati This is a bit of an x-y problem. What are you trying to achieve, specificially?
    – sfdcfox
    Feb 15, 2022 at 20:53
  • Trying to implement anti csrf token for POST ajax requests without saving tokens in Salesforce platform. Feb 15, 2022 at 20:55
  • 2
    @SatishakumarAwati There's easier ways to make a CRSF token, and that's assuming that the built-in CRSF system isn't already good enough. You might want to ask about that, instead.
    – sfdcfox
    Feb 15, 2022 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .