14

I've read a lot of docs for this and I'm not completely sure of what are the conditions for the login verification code be asked. Can someone please help with this question and clarify me? Thanks

Improve this question

3 Answers 3

Reset to default
13

There is a really good help topic that outlines the various controls on login access to your org. Paraphrasing from it:

  1. The first thing that is checked on any login is your profile login hours. If you have login hours on your profile, and you are outside login hours, the login process stops and you are denied access. No further checks are done. If you don't have login hours set, or if you are within login hours, you move to step 2.
  2. Next we look to see if your profile has an IP restriction set on it. If you do and you are not within the login IP range, you are denied access. No further checks are done. No verification email. Nothing. Your access is blocked absolutely. If you are within your profile IP range, you are granted access.
  3. If there is no profile IP range, then we will look for a browser cookie set that identifies that this user has accessed this org previously, or if they are within the organization-wide IP restrictions (Setup>Security Controls>Network Access). If you are your browser does not have the cookie, or is you are not within the org-wide range, your access is blocked...but...there are two ways to still gain access.

Step 1 is just a gatekeeper step. You won't be granted access solely based on login hours, but you must meet the criteria to get access.

Step 2 is absolute and if a profile IP range is in place completely supersedes step 3.

Step 3 only is tested if there is no profile IP range.

If Step 3 blocks your access, as I mentioned two other options exist to gain access.

  • The user can click on the Email Me a Verification Code button, in which case it will be emailed to them (SMS is also an option today) and they enter in the code to gain entry. The system will then set a cookie in the browser for the next time they access the org from that endpoint.
  • The user can pass their security token in with the password.

The first time a new user logs into an org, if there are no IP range restrictions, they will be granted access and the cookie is set.

Improve this answer
3
  • Hi @Peter:How can I skip the verification code
    – kunal gupta
    Apr 5, 2016 at 21:08
  • If you login from within the trusted IP range designated in your profile you will never be asked for a verification code. Currently, there is no way to turn this feature off.
    – pchittum
    Apr 6, 2016 at 12:51
  • @Peter what about private browsing? I'm having to type the security code in every time..
    – Jacob Raccuia
    May 19, 2016 at 17:49
1

The verification is asked when the user is logging in from a system where there hasn't been a previous login (where there isn't a cookie present), or where the previous login has been expired (cookie expired)

System can be a physical system, but it can also be another client (Chatter Desktop for example), another browser, ...

Improve this answer
0

Although supposedly cookie-based, why is it that deleting all cookies, or even using private browsing mode in Firefox, does not set off the verification code requirement? The only thing that causes it to show seems to be several days of not using a given system (or just several days regardless of use or lack thereof). If it is cookie-based, then how is Salesforce dropping cookies that cannot be deleted or that survive clearing them out? Smells like they have another way...anyone?

I have seen other sites (namely banks/credit card companies) use a similar system, but that is definitely cookie-based, as private browsing mode fails and/or clearing cookies will require new verification, but not with Salesforce...

Improve this answer
1
  • It's not entirely cookie-based (if only partially), but IP-based. That is, even with private browsing or cleared cookies, if your login is from a "new" IP (and, since we get these on systems that have been used in the past with the same static IPs, then also if that IP has not been used to login in a certain amount of time prior), then you will have to go through verification again, even on a system you may have already used. That explains why cookie-clearing and private browsing work fine (and Salesforce "remembers" that you don't need to verify in those cases) as well.
    – ConspiracyTheorist
    Feb 11, 2014 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .