Based on threads such as Calling Apex Rest custom web service from Apex code we have HTTP calls in our Apex code (contained in a managed package) back to the same org authorized like this:

HttpRequest req = new HttpRequest();
req.setHeader('Authorization', 'OAuth ' + UserInfo.getSessionId());

Today in a sandbox that is running Winter '15 we are always getting a 401 (Unauthorized) status back with a body of:

    "message":"Session expired or invalid",

We've had a look through the Salesforce.com Winter ’15 Release Notes and don't see any direct change in this area.

Has anyone else had a problem with this sort of code in a Winter ’15 preview org?

PS Just tested from the developer console with an SA User and the call worked. The User involved where we get the problem is the "Site Guest User" of a Force.com Site. However, this could also relate to the observation that different session IDs are returned depending on whether the call is made from inside a managed package or not - see Get a FIRST-CLASS SessionID for API Calls (looking for a clean way or alternative).

PPS Based on creating a simple test page, it looks like UserInfo.getSessionId() now returns null for a "Site Guest User" of a Force.com Site in in Winter '15 preview whereas before that it returned a valid session ID. This change in behaviour is not API versioned.

  • did u raise this with salesforce support ? – Vamsi Krishna Gosu Sep 9 '14 at 11:55
  • @VamsiKrishna No but I will at some point today if nothing gets posted here. – Keith C Sep 9 '14 at 12:07
  • We have created a case about UserInfo.getSessionId() now returning null within a Force.com Site. – Keith C Sep 9 '14 at 20:10
  • What would be the latest status of this issue? are there any new solutions, I still get this UserInfo.GetSessionId() null. – Hasantha Mar 5 '18 at 5:24

Salesforce backed out this across-the-board change and made it a versioned changed. API Version 31 and earlier will continue to return the session ID from UserInfo.getSessionId() when in the Sites guest user context. Your VF Page and Apex Controller must be Version 31 or earlier.

The patch hit the Winter '15 sandboxes last night (Sept 30) and will hit the only production instance (NA1) currently running Winter '15 tonight and will be included with the rest of the pod upgrades on Oct 3rd and Oct 17.

(This is not documented publicly as a Known Issue nor included in the Release Notes)

  • 1
    Wish I had this information before I spent several days implementing an alternative which I will now go back and remove. Thanks for posting this. – Keith C Oct 1 '14 at 10:29
  • We also had an alternative implemented (anonymous Apex REST call) but after a call with a PM, they agreed this could have significant impact and decided to version it instead. It's been a long 3 weeks for us. – daveespo Oct 1 '14 at 13:57

Support have come back with:

confirmed with R&D that this is not a BUG rather a security update that is introduced in Winter'15 release

and advise:

affected customers will need to adjust their integration's to not rely on a guest session ID


I faced the similar issue. We passing ConsumerKey, ConsumerSecret, username and password.

It is working fine initially. after 3 months we faced the sessionid issue. We tried and spent around 1month to resolve it.

Solution for this issue:

Concatenate the security token with your existing password. Security token will be created for a user.

Sample: passwordsecuritytoken

we tried this option and worked successfully.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.