Consider this scenario:

Customer goes to my force.com site. Ex: www.mysitename.com

Customer logs in to authenticated force.com site with custom URL. Domain.secure.force.com

Customer closes window/tab, goes anywhere else. Customer comes back to the public URL.

Here's the problem...to them, the site appears like they aren't logged in. If they do try to log in, they will get a visualforce error page because they're already logged in.

Ideal scenario...public page recognizes they're still the same user and shows them logged in.

Decent hack...we catch the "already logged in" error and do a redirect to the secure site without telling the user. OR, kill the previous session and start a new one...as long as the user isn't impacted.

How can I make the site do one of these "smarter" behaviors?

  • Were you ever able to accomplish this? I'm having a similar issue
    – Phil B
    Commented Oct 31, 2013 at 17:50

3 Answers 3


You could just not display the log in form if the user is already logged in, but instead displays a link to whatever the action of logging in takes them to or do whatever it is you want to for the logged in user when they visit the main page.

So, on the VF page that displays the www.mysitename.com have something like:

<apex:outputPanel rendered="{!ISPICKVAL($User.UserType,'Guest')}">
     Not logged in.  Code for log in form goes here.
<apex:outputPanel rendered="{! NOT(ISPICKVAL($User.UserType,'Guest'))}">
     Logged in. Code for link to post log in landing page or something else.

If you'd rather have them redirected immediately upon accessing the public page while logged in you could use an apex:page action on the public page. Something like the following:

<apex:page controller="MyMainPageController" action="{!redirectIfLoggedIn}">

Then in the MyMainPageController, something like:

public PageReference redirectIfLoggedIn() {
    if (UserInfo.getUserType() != 'Guest') {
        PageReference loggedInPage = getLoggedInPageSomehow();
        return loggedInPage;
    // Guest user so just display as usual.
    return null;
  • I think the issue is that rendered="{!ISPICKVAL($User.UserType,'Guest')}" is part of my page header (displays the log in link) and it's not picking up that they're still logged in. Commented Aug 22, 2012 at 5:13
  • And on the 2nd option (redirect action) the problem is that the page (homepage as well as many others) exists on both the secure and non-secure site. So that would create a never-ending redirect loop if they were logged in. Commented Aug 22, 2012 at 5:15
  • Ahhhh. Are you saying that you actually have two different sites? When you go to Setup > Develop > Sites you have two sites listed? I missed that part. Is there any reason why they are two different sites as opposed to just one site which has a public portion and an authenticated (backed by customer portal) portion? Commented Aug 22, 2012 at 10:21
  • Just one Setup>Develop>Site. Sorry for the confusion. I just meant that after they log in they're on the secure.force.com domain, but before logging in they're on the www.customdomain.com domain. It's ACTING like 2 sites. Commented Aug 22, 2012 at 14:40
  • OK. So when they come back to the public page www.mysitename.com the Log In link shows up instead of the Welcome, User. Could that link be hardcoded to the secure.force.com domain (login has to be over SSL anyway) and have it take them to a separate login page? Then on that login page you'd know if they were the 'Guest' user or not and not display the log in form if they are already logged in. Display a message like you are already logged in, or redirect them othrewise. How is it handled now if they just navigate directly to the log in page when already logged in? Commented Aug 22, 2012 at 15:00

Registering a Site domain and Maintaining a Session For all those people who want to register and free force.com site and maintain a session for users, I request you to first create a fresh developer.force.com account even if you have one and follow the following steps.

WORDS OF WISDOM Instead of finding out why the problem is occurring in your existing portal and debugging it, create a new one and copy all your objects through workbench(If you don't know how to do this, share your email id and I will send you a ppt defining this step by step process), copy and paste visualforce pages and apex classes to your new force.com account.

STEPS 1. Customer Portal -> Settings -> Activate the portal, Enable Self Registration, Set Default New User License as Customer Portal Manager Standard, Set Default User Role as User and Default New User Profile as Customer Portal Manager Standard.

  1. Create an Account and copy its Account ID

  2. Manage Users->Roles->Company size based sample-> Set up Roles->Either Add Role or Assign to existing role the above account created.

  3. Develop->Sites->Search availability and register a domain

  4. Edit the Site Details by providing name and other details. To start with keep the homepage as SiteLogin, Change Password as ChangePassword page and Profile Page as MyProfilePage.

  5. Activate the Site

  6. Click on Site Name and go to Login Settings->Edit->Select the customer portal so created

  7. Now the site is activated and login is enabled

  8. Go to SiteRegisterController page->Edit -> Replace the default PORTAL_ACCOUNT_ID with the above copied Account ID

  9. Go to MyProfileController->Edit->Comment the if condition which throws exception in case of Guest User.

  10. Go to SiteLoginController , change the return value of the login method with ‘return Page.MyProfilePage;’

  11. Go to Develop ->Sites->Click on Site URL

  12. If all the steps are done correctly, the Site will show hyperlinks for NewUser, ForgotPassword and Login on the Header as well as on the Output Panel.

  13. Click on New User, enter the details and on clicking submit you will be redirected to the Login page. Enter your username and password registered. If all the above steps are done correctly, you will be directed to the MyProfilePage which will show you the logged in user credentials alongwith change password button and a logout button.

  14. Copy paste the same URL on another browser or private browsing or incognito window and you will see the message of authentication required.

  15. If you click on Logout, you will be redirected to the login page again.


The final answer on this was to migrate to customer communities. This keeps everything on the same custom domain, including https, so there's never a login button shown for people with a session.

The original challenge was more of a feature limitation of custom domains on authenticated sites.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .