I think I've discovered an OAuth Remote Action bug. The behavior I'm seeing is that when I navigate to a Visualforce page, using the oauth_token parameter to authenticate, the Visualforce page displays correctly but Remote Actions return an exception message:

Error parsing json response: 'syntax error'. Logged in?

To reproduce this error create a Visualforce page named OAuthRemoteActionBug and an Apex controller with the same name using the code below. Then, navigate to the OAuth Authorize URL below and cut and paste the access_token fragment out of the URL you are redirected to. Finally, visit the OAuthRemoteActionBug Visualforce page appending the access_token via the oauth_token parameter. The page will load correctly, but when you click the Remote Action button it will alert the exception message above.

<apex:page controller="OAuthRemoteActionBug" docType="html-5.0" showHeader="false" standardStylesheets="false" cache="false">
    <script type="text/javascript">
        function remoteAction() {
            OAuthRemoteActionBug.remoteAction(function(result, event){
                alert(event.message ? event.message : result);
    <button onclick="remoteAction();">Remote Action</button>

public class OAuthRemoteActionBug {
    @RemoteAction public static String remoteAction(){return 'Success';}



  • 1
    Have you logged a case with Salesforce? – Daniel Blackhall Nov 6 '12 at 22:32
  • Yes, Case 08359363 – mjgallag Nov 7 '12 at 16:07
  • 1
    One for our inhouse OAuth gurus superfell or @metadaddy I reckon. – techtrekker Nov 7 '12 at 16:25
  • FYI, I tried widening the scope i.e. api chatter_api full id visualforce web, as a workaround, but it didn't help. – mjgallag Nov 7 '12 at 16:47

Visualforce Remoting in Summer '13 has better support for OAuth. See link below for details. Blog and examples to soon follow.

OAuth 2.0 Authentication for JavaScript Remoting

| improve this answer | |
  • Can you add some of the relevant content to the answer so that the information is readily available? – Matt Lacey Jun 25 '13 at 2:11

The oauth_token parameter method DOESN'T set the sid session cookie that Remote Actions need to function properly.

The frontdoor.jsp method DOES set the sid session cookie that Remote Actions need to function properly.

The Mobile SDK uses the frontdoor.jsp method, see SFHybridApp.js line 247.

It's important to note that a visualforce scoped oauth access token will not work with frontdoor.jsp, it needs to be web scoped. I'm guessing this is why the Mobile SDK switched from using visualforce to web, see commit Changing default scope from visualforce to web.

Though I found the oauth_token method on a developerforce blog post "append the OAuth access token to a VF URL and direct users to it (for e.g. ‘https://c.cs0.visual.force.com/apex/HelloWorld?oauth_token=’)" and the frontdoor.jsp method is used in the Mobile SDK it seems neither of them are official supported "No, there's no supported equivalent of frontdoor.jsp yet. – superfell Jan 3 at 23:23".

| improve this answer | |
  • @superfell please feel free to add your two cents here, thanks – mjgallag Nov 11 '12 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.