Hot answers tagged

32

So, as it turns outs there is no way of getting a valid API-capable Session Id from lightning component, here is a quote from the partner discussion forums: Three things: There's no $Api global variable in Lightning Components today. So, {! $Api.whatever } will always fail. This is intentional at this time. There's no official/supported way to get an API-...


24

A session ID identifies a user using the UI or an API/integration tool. It has a set time to live and may be manually expired by explicitly logging out. It may also be tied to a specific IP address, if configured. Session ID values are valid across all APIs, including SOAP and REST endpoints. Access Tokens are used by Connected Apps and other OAuth-enabled ...


16

As I know: Session Id: SessionId is obtaines when use login from web interface or does a soap api call. A session is bind by user login time and activity and expires after if user remain idle for specific time. AccessToken: Access token is a part of standard OAuth flow. It allows to do operation on behalf of user which authorize a connected app or other ...


16

Per the documentation: Global variables - $Api You can use this expression in your VF page markup. {!$Api.Session_ID}


13

I think the only way you can use your Session ID for frontdoor.jsp is if it was generated in the context of a first class Salesforce session: ie $Api.Session_ID on a Custom Link or Custom Button appearing on a native page layout on the *.salesforce.com domain or *.my.salesforce.com (per 'My Domain' feature), or Developer Console (tooling API), Eclipse ...


9

You can get the session token from the cookie of the browser. The name of the cookie is 'sid'. In Chrome, you can find the cookie by going to settings->advanced settings->privacy->content settings->allcookie and site data and then seacrch for yourinstance.salesforce.com and select the sid cookie and the copy the content of this cookie.


9

Unfortunately, I don't have an answer for you in terms of a workaround. I did spend some time trying to figure this out because I have a package that makes use of getSelected() on a list view and is in use in lots of orgs so was/am concerned about this breaking too. I'm now of the opinion that the problem is org specific. Here are the tests that I ...


9

In Winter '18, they added an ability to control access to Apex REST Services that is distinct from the API Enabled permission on profiles that provides access to the standard APIs. This allows you to set up a profile that does not have access to the standard APIs, but gives you access to Apex REST Services. The user will also need access to the apex class ...


7

Received an answer from Salesforce support: First of all, header parameter names listed in the documentation are wrong. They should be: X-LIVEAGENT-AFFINITY X-LIVEAGENT-SESSION-KEY X-LIVEAGENT-SEQUENCE X-LIVEAGENT-API-VERSION (this is the only one correctly named in the docs) To have the sessionId call return the affinity token, along with the X-...


7

I have seen client id's and some passwords which need to be urlencoded/escaped to work well with curl. Maybe you should try the --data-urlencode option (source: https://stackoverflow.com/questions/10060093/special-characters-like-and-in-curl-post-data ) Example usage would be: curl -v https://test.salesforce.com/services/oauth2/token -d "grant_type=...


7

According to the known issue Summer'17- Generating a Session Id from Lightning Domain Provides Invalid Session Id (W-3981698) it should be possible to pass UserInfo.getSessionId() out to lightning component via an @AuraEnabled an use it for API calls. This should be possible from Winter '18 onward.


7

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as defined in Setup > Network Access > Trusted IP Ranges): Boolean isTrustedIp = false; Map<String, String> sessionAttributes; try { ...


6

Use an incognito window or a different browser. You should only experience this issue if both orgs are on the same instance, e.g. cs12.


6

Just an update for anyone facing the same issue. After raising a case with SF we could confirm that the refresh function is only triggered to get new session Id in case the previous callout return '401' status code only (Only way for SF to know that the session is expired)


5

The correct format for the Authorization header is Authorization: Bearer {access_token} e.g. if your access token value is bobsaccesstoken then the header should be Authorization: Bearer bobsaccesstoken So your code needs changing to 'Authorization: Bearer ' . $accessToken


5

Set up My Domain in your production org, then refresh your sandboxes. They'll each get unique domains, and will allow you to work seamlessly in multiple orgs. The URL for each sandbox will change to something like "https://mydomainname--sandboxname.instance.my.salesforce.com/". This lets you open many sandboxes with virtually zero risk of sessions getting ...


5

It works pretty much as you've suggested. Send the users browser to: https://eu5.salesforce.com/secur/frontdoor.jsp?sid=sessionId&retURL=%2F0032400000GRVvYAAX Remember to URL encode the forward slash in the retURL parameter. As Rahul Sharma commented, check the casing of retURL as well. The casing needs to match exactly.


4

Yes. It is stored in a cookie named sid so a var sid = document.cookie.match('sid=([^;]*)')[1]; Should do the work. Or if you want something simpler to read var strCookies = document.cookie; var cookiearray = strCookies.split(';') for(var i=0; i<cookiearray.length; i++){ name = cookiearray[i].split('=')[0]; value = cookiearray[i].split('=')[1]; ...


4

The problem is with this line here param.putAll(ApexPages.currentPage().getParameters()); and in particular with the save_new parameter that is being added to the URL causing the error. Similar issue here, Error while PrePopulating Name in Opportunity


4

"Access Tokens", as well as "SOAP Session Identifiers" ("sid" for short, in most cases) are all treated the same. They are sessions that have an expiration date. You can see your sessions in Setup > Security Controls > Session Management. Any use of a session at least 50% of the way through the expiry time, such as running ...


4

According to the definition Lock sessions to the IP address from which they originated Determines whether user sessions are locked to the IP address from which the user logged in, helping to prevent unauthorized persons from hijacking a valid session. Since you are already using same machine to access Salesforce and workbench and other things thats why ...


4

I know we can configure session timeout, but how can we get the configured session timeout value in Apex code? String sessionLength = Auth.SessionManagement.getCurrentSession().get('NumSecondsValid'); Does Salesforce provide helper function to calculate the remaining session time for current logged in user? No. For example, the session timeout is set ...


3

Instead of using PageReference.getContent can you use an HttpRequest to achieve the same? Something like: HttpRequest request = new HttpRequest(); request.setMethod('GET'); request.setEndpoint(Url.getSalesforceBaseUrl().toExternalForm() + '/home/home.jsp'; request.setHeader('Cookie', 'sid=' + UserInfo.getSessionId()); HttpResponse response = new Http()....


3

Following @eric's recommendation, I was able to use login() which indeed seems to return a full powered first-class sessionId - at least for my requirement I finally got the logs! Instead of using the WSDL I found a much simpler way to use the AJAX Toolkit just with sforce.connection.login(username,passwordAndToken); In the end it will do the same callout ...


3

No, the only legal values are the ones specified by salesforce.com. You could create a sidebar component to enforce a custom timeout, but that would only affect browser sessions and not API sessions.


3

It's 2019... Now salesforce has provided ability to capture the logout event by releasing an object LogoutEventStream as a beta feature. After LogoutEventStream is enabled, Salesforce publishes logout events when users log out from the UI. You can add an Apex trigger to subscribe to those events. You can then implement custom logic during logout. For ...


3

You can do this using the JWT Bearer Token flow. Basically you register an OAuth app and authorize that app for the users you wish to impersonate. Now your future method will create a JWT Bearer Token containing the target user's username and exchange that for an access token with which you can call the REST API. There is code to do this linked from this ...


3

I just tested a very basic Bulk API Job to insert two new contacts. At the same time I created a new trigger for before insert on contacts that contained the following: string sessionId = UserInfo.getSessionId(); System.debug(LoggingLevel.Error, 'UserInfo.getSessionId(): ' + sessionId); System.assert(!string.isBlank(sessionId), 'Expected sessionId'); The ...


3

The tab IDs are unique within a console, but not guaranteed to be the same if you close and reopen a tab or if you leave and re-enter the console. So you may have primary 'scc-pt-0' with a subtab 'scc-st-0' and 'scc-st-1'. If you close that primary tab then reopen it then it's possible it will now be 'scc-pt-1'. But if you leave the primary tab open it will ...


3

Any activity on a session ID resets the timer. This includes polling, streaming, or generally doing anything at all that interacts with the user. Worse, implementing your own time out method in your page (e.g. calling /secur/logout.jsp if no action is detected), may result in the user's session expiring in a different tab, etc, which many users tend to do ...


Only top voted, non community-wiki answers of a minimum length are eligible