17

I'm using a force.com site and it has a login method that allows you to redirect them to different landing pages from within apex via Site.login(username,password,url). However it appears there is no Site.logout() method. Its my understanding that logout is configured via the customer portal settings and then called using {!$Site.Prefix}/secur/logout.jsp.

My issue is what if I want to redirect the user to different logout pages conditionally? Is there any way to do this or am I stuck using only the URL in the customer gateway settting.

Thanks!

Improve this question
1
  • No official support for conditional logout pages. Editing the logout URL on the portal is the best you can do.
    – Ryan Guest
    Mar 13, 2013 at 7:51

3 Answers 3

Reset to default
17

You are correct, there is no Site.logout() method, sadly. Directing to the /secur/logout.jsp page is the only Salesforce-blessed method I know of for doing logout, and doesn't support any conditional logic, AFAIK.

A few semi-hackish options, in the order of how likely they are to meet your requirement.

  • I'm not 100% sure, but pretty sure, that Apex cookies (set via Cookie class) that are longer-than-session-lifed don't get cleared when a user signs out in the context of Sites. If that's the case, you could potentially use the cookie to transport data to your post-login-page, which would do different things depending on the cookie contents. This wouldn't be considered secure if there is any data in the cookie that would be identifying, but for something like "show the Brand A signout page or the Brand B signout page" it would probably be fine.
  • although not blessed by Salesforce, you can invalidate a Salesforce session by invoking /secur/logout.jsp "in the background" (via iframe or ajax-style web call). So theoretically you could have a VF page handle the login click, make your conditional logic determination, then redirect them to the page that has the embedded /secur/logout.jsp call in it.
  • although not blessed by Salesforce, you can also effectively invalidate a user's session by manipulating the Salesforce session cookies (i.e. clearing them). Numerous issues with this approach: this doesn't kill the server-side session, so would be considered less secure than #1; the cookies are also subject to change over time; and is not very Salesforce-ish.
  • could probably think of a couple other options if I knew a bit more about your requirements - what these conditional pages do and how the conditional logic can be fired.
Improve this answer
3
  • 1
    Interesting options! Thanks I think I'm gonna try the first cookie option. I was kinda hoping the logout.jsp page would accept a retUrl attribute or something that would override the value set in the customer portal setting.
    – Phil B
    Mar 12, 2013 at 14:54
  • 1
    But what if you want to expire the session inside a REST call. Assuming someone has authenticated and sent a message to my REST service, can I expire or logout the session at the end of the handler?
    – tggagne
    Jun 30, 2014 at 16:37
  • 1
    @tggagne - yes, this is a totally different case. Salesforce OAuth does support explicit token revocation which kills the user session: help.salesforce.com/…
    – jkraybill
    Jul 1, 2014 at 0:44
5

What I did:

In your customized logout page(s) use a no-height, no-width apex iframe of the logout page.

To get the rest of your requirements, you can pass the url of where you want to go as a parameter, wait a few sec, and then redirect.

For total flexibility, make the iframe part of your site template and do a rendered tag on it so that it only shows if a URL parameter (logout) is present. Then any page could be your logout page.

Improve this answer
1
  • Hey Shane do you mind sharing a sample code to your process? Thanks.
    – sw6 - KTBFFH
    Sep 26, 2013 at 18:37
2

@Jesse Altman Hi Guys, The ideas suggested by Shane would work. Just to be cautious on one thing. Make sure you test your login with multiple tabs with the same user logged in. For e.g login with a user and create a new tab and try to hit the login page. You would see weird controller errors since it is using the same session . So try to force the logout if the user forgot to exit cleanly on his login session. Buyan

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .