Can anyone think of a way, from within Apex, to tell if a User's session has expired / been invalidated?

Our app is very JS Remoting intensive, so it would be nice if we were able to detect, from within a @RemoteAction annotated method, whether a User's session has expired. Or does anyone know, will the Session Id, as returned from UserInfo.getSessionId(), be null if it has expired / been invalidated?

  • Is there a reason why you couldn't just handle the exception in your remoting javascript? – Daniel Blackhall Nov 19 '12 at 21:11
  • Daniel, the 'Visualforce Remoting Exception' is thrown by Visualforce's internal JavaScript, as a result of AJAX, so it's pretty difficult to catch. – zachelrath Nov 28 '12 at 14:05
  • That's frustrating, I didn't think it would throw an exception, but return an error ajax response. – Daniel Blackhall Nov 28 '12 at 22:06

I suspect your apex won't be run if there will be a timeout (meaning that for all practical purposes you can treat UserInfo.getSessionId() as never null).

Can you wrap your methods in client-side check?

var currentTime=new Date().getTime();
var sessionTimeLeft=secondsLeftValue-((currentTime-lastPageActivityTime)/1000);

It's based on stuff you can see when you view page source a bit under <form id="sessiontimeout"...

Alternatively maybe you can make a simple call to server from JS before calling actual remoteAction?

See sample calls in the AJAX toolkit. You'd have to query for something or perhaps retrieve something really small:

var result = sforce.connection.getServerTimestamp();

var user = sforce.connection.getUserInfo();
log("Hello " + user.userName);
log("Your email id is " + user.userEmail);
log("and you work for " + user.organizationName);

But I recall reading somewhere we shouldn't mix VF and the connection.js library...

  • Yes, I had thought about that, as it would work for session timeout detection client-side, but what if the user's session has been invalidated or they've been logged out? When that happens the client just gets thrown hidden/unseen `Visualforce Remoting Exception' messages, which are very difficult to trap client-side using try/catch. So the client user thinks the app's broken, when it's actually there session that's been invalidated, not timed-out. – zachelrath Nov 19 '12 at 13:30
  • I think this might be the right route in general, with some changes. You've got a catch 22 trying the Apex route, because anything that will legitimately reach Apex will need a session ID, etc. It sounds like the user is leaving the interface open, and say - returning from lunch. I would setup a distinct loop to track idleness, like a global countdown which gets reset everytime your JS Remoting gets a success back. If the countdown gets to like an hour (though I think sessions might be 2), block the UI and force the user to do a session check. – joshbirk Nov 19 '12 at 16:22
  • I think @joshbirk is right on this one, trying to catch this from Apex is a Catch-22, and I think that with regards to RemoteActions, which my question was targeted at, eyescream's idea about doing a 2-step check is what makes the most sense: 1) check to see if the Session Timeout interval has expired (this info is stored in a global JS variable set by Salesforce (allowing their little 'session is about to expire' popup window to work) 2) try to catch VF Remoting Exceptions / do dummy calls to AJAX toolkit. The dummy calls though consume API calls, so are non-ideal. – zachelrath Nov 28 '12 at 14:06

You could write a custom web service to test whether the session is valid and then make a web service request to check this (if you wanted to use the token).

You would need to define a web service that would simply return true if the user could access it. Then expose this as a web service and generate the wsdl file for it before reimporting it to make the call.

Alternatively, look at something like the FinancialForce metadata wrapper https://github.com/financialforcedev/apex-mdapi - just attempt to login to that. If your session Id is valid you will be able to login otherwise you will not.

  • I like the idea of doing a callout to Salesforce for a login, but that requires doing a callout every time the user runs a Remoting function --- not ideal. – zachelrath Nov 19 '12 at 13:31
  • Sorry for the delayed reply. I agree, but you could then cache it with some sort of timer to know whether you need to think about checking again? – pbattisson Nov 28 '12 at 7:47
  • Yes, the timer caching is a good idea as well. – zachelrath Nov 28 '12 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.