1

Is the login for experience cloud sites no more supported using frontdoor.jsp? As per this article, it should be.

For some quick testing, as given here, I'm using the form element sample inside a simple HTML page. I've extracted the session ID from SOAP login response made via SOAP UI tool and embedded the same in my html. And the URL used is in the format https://<my-domain-name>.my.salesforce.com/secur/frontdoor.jsp. It works for standard salesforce site, but not for community sites anymore. I'm always get redirected to the community login page instead.

I came across an article that suggested that the URL to be used for community sites should be in the format: https://<my-domain-name>.my.site.com/<any-community-suffix-url>/secur/frontdoor.jsp. I've tried this too but doesn't work.

Improve this question
5
  • From the doc: Not all session types are supported with frontdoor.jsp, such as Experience Cloud site API sessions. For these sessions, consider using SAML for single sign-on, instead. You have several ways to get a Session ID, such as from UserInfo.getSessionId() in Apex, $Api.SessionID and other sources. Sometimes the ID values from these sources vary depending on context, don't work with frontdoor.jsp, and can pose security risks as you use them. Use the access_token from an OAuth authentication instead
    – identigral
    Commented Jan 20, 2023 at 17:28
  • I've seen this. Won't be able to use UserInfo.getSessionId() & $Api.SessionID because I'm trying to load the experience site inside a 3rd party mobile app (which uses Salesforce Mobile SDK). However, while trying out this feature on the mobile app, I've used the access_token obtained from OAuth authentication. But the same behavior was observed. Just to ensure that this works in a normal web page load firstly, I've tried this on a simple HTML page using the token from SOAP API login call. I believe the SOAP call gives the same session ID or equivalent as OAuth.
    – arut
    Commented Jan 21, 2023 at 3:43
  • Ref to this link, Session contexts are based on the domain of the request. That is, the session context changes whenever you cross a hostname boundary, such as from .salesforce.com to .vf.force.com or .lightning.force.com.. If I make a SOAP API login call, I believe the response should be giving me the session token from .salesforce.com
    – arut
    Commented Jan 21, 2023 at 3:46
  • .my.site.com is an Enhanced Domain site. What's the outcome of your test in an org without Enhanced Domain? How about the same test with and without Enhanced Domain in Winter '22 org
    – identigral
    Commented Jan 22, 2023 at 17:37
  • The outcome remains same for sites with as well as without enhanced domain. Also, checked playing around by hardcoding access token/ session ID from REST API end point as well as SOAP end points. Always getting redirected to the community login page.
    – arut
    Commented Jan 23, 2023 at 9:53

1 Answer 1

Reset to default
0

Is the login for experience cloud sites no more supported using frontdoor.jsp?

No, it is still supported. All I needed was to get the session token from the community domain/ login. As mentioned in my comment (ref: link), Session contexts are based on the domain of the request. So, the session or access token for the community site (my.site.com domain - for orgs with enhanced domain) will be different than the ones fetched via SOAP login, UserInfo.getSessionId() or $Api.SessionID. In my case, I was able to get this via OAuth, since my actual requirement was to get this token in a mobile app.

Access tokens received from a domain can be used to login to a page within or served from that particular domain only using frontdoor.jsp. The URL to be prefixed to secur/frontdoor.jsp can be actual instance URL and it need not be domain specific URL.

Additional Info: On the Setup > Session Management page, the details of community site specific token can be observed (of type ChatterNetwork).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .