Skip to main content
11 votes

Getting Session ID in Lightning

There is a Salesforce-accepted way to do this. Use a Named Credential along with a Connected App and Auth Provider (which will be Salesforce). The Named Credential will be used as your endpoint ...
womanwhodevs's user avatar
9 votes
Accepted

Session Id not getting refreshed automatically with Custom Auth provider in Salesforce Named Credentials

Just an update for anyone facing the same issue. After raising a case with SF we could confirm that the refresh function is only triggered to get new session Id in case the previous callout return '...
Abhijeet Bhandari's user avatar
9 votes
Accepted

Can API access be limited to only via Apex classes?

In Winter '18, they added an ability to control access to Apex REST Services that is distinct from the API Enabled permission on profiles that provides access to the standard APIs. This allows you to ...
Kris Goncalves's user avatar
8 votes

Getting Session ID in Lightning

According to the known issue Summer'17- Generating a Session Id from Lightning Domain Provides Invalid Session Id (W-3981698) it should be possible to pass UserInfo.getSessionId() out to lightning ...
Daniel Ballinger's user avatar
7 votes
Accepted

Can we use the use frontdoor link to redirect to a salesforce record directly by passing parameters?

It works pretty much as you've suggested. Send the users browser to: https://eu5.salesforce.com/secur/frontdoor.jsp?sid=sessionId&retURL=%2F0032400000GRVvYAAX Remember to URL encode the ...
Daniel Ballinger's user avatar
7 votes

Determine whether running user is logged in from within Trusted IP Range (from Apex)

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
Brent Bowers's user avatar
  • 3,144
6 votes
Accepted

Sandbox session gets confused across browser tabs

Use an incognito window or a different browser. You should only experience this issue if both orgs are on the same instance, e.g. cs12.
Adrian Larson's user avatar
  • 151k
5 votes

Sandbox session gets confused across browser tabs

Set up My Domain in your production org, then refresh your sandboxes. They'll each get unique domains, and will allow you to work seamlessly in multiple orgs. The URL for each sandbox will change to ...
sfdcfox's user avatar
  • 497k
5 votes

Session expiry in Salesforce - Session timeout value for Connected Apps

If you read properly in the link you have provided, The expires_in attribute is given on the call back URL and not as web service response. Even if you get expires_in there is still a catch. The ...
Pranay Jaiswal's user avatar
5 votes

How to get remaining session time in Apex for current user

If you happen across the documentation on the AuthSession object, you'll get a helpful hint (emphasis mine): LastModifiedDate Type dateTime Properties Defaulted on create, Filter, ...
Adrian Larson's user avatar
  • 151k
5 votes
Accepted

Why values does not match for GETSESSIONID and getSessionId?

Salesforce has multiple domains, such as visual.force.com, lightning.com, org.my.salesforce.com, etc. When you log in, a parent session is created; depending on how you log in, you'll get a different ...
sfdcfox's user avatar
  • 497k
4 votes
Accepted

Do access token expiration times reset/get updated every time they are used?

"Access Tokens", as well as "SOAP Session Identifiers" ("sid" for short, in most cases) are all treated the same. They are sessions that have an expiration date. You can ...
sfdcfox's user avatar
  • 497k
4 votes

How to test XSS/Content Sniffing protection in sandbox?

According to Platform Security FAQS. X-Content-Type-Options: no sniff The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > ...
Daniel Ballinger's user avatar
4 votes
Accepted

Lock sessions to the IP address from which they originated

According to the definition Lock sessions to the IP address from which they originated Determines whether user sessions are locked to the IP address from which the user logged in, helping to ...
Santanu Boral's user avatar
4 votes

Is session duration guaranteed?

Separating your questions. My question is however, is this value of 2 hours guaranteed as a minimum session length? Will it always be at least 2 hours? Yes and No (No if a User ends the ...
Jayant Das's user avatar
  • 30.6k
4 votes
Accepted

How to get remaining session time in Apex for current user

I know we can configure session timeout, but how can we get the configured session timeout value in Apex code? String sessionLength = Auth.SessionManagement.getCurrentSession().get('NumSecondsValid');...
sfdcfox's user avatar
  • 497k
4 votes
Accepted

What is the difference between UserInfo session Id and Auth session Id?

UserInfo.getSessionId() should be the usual way to access the Session Id for a user. Please note, however, that even this method can return null: You can use getSessionId() both synchronously and ...
sfdcfox's user avatar
  • 497k
3 votes
Accepted

Session Settings

They have different meanings. From this doc: Lock sessions to the IP address from which they originated Determines whether user sessions are locked to the IP address from which the user logged in, ...
Sebastian Kessel's user avatar
3 votes

How can I find the AuthSession that corresponds with the current Session Id?

This is now partially possible using AuthSession.IsCurrent: If true, the session is a member of the user’s current session family. This was introduced in Summer'16 (v37.0).
Daniel Ballinger's user avatar
3 votes

Salesforce logout hook

It's 2019... Now salesforce has provided ability to capture the logout event by releasing an object LogoutEventStream as a beta feature. After LogoutEventStream is enabled, Salesforce publishes ...
Ayub's user avatar
  • 3,543
3 votes

How can we ensure sessions time out?

Session time outs only occur when the user doesn't do anything for the specified time window. If a user is "happily working" in salesforce, they're doing something, and so they won't be timed out. If ...
sfdcfox's user avatar
  • 497k
3 votes

How to Make Session Expire with Salesforce Connected App Web Server Flow

Session Timeout Org defaults is overrrided by Profile's Session Timeout Value. Make sure that's also 15 mins. You can control session settings on a user profile basis. If you don’t configure the ...
Pranay Jaiswal's user avatar
3 votes
Accepted

INVALID_SESSION_ID when calling Salesforce services from Java

This is a pretty common problem. After you call the login method you get a LoginResult back in the response. That response includes the sessionId that you then need to include in the in the ...
Daniel Ballinger's user avatar
3 votes
Accepted

System.UserInfo.getSessionId() and metadata API

Lightning Components' Apex controllers do not receive an API-enabled session: By security policy, sessions created by Lightning components aren’t enabled for API access. This prevents even your Apex ...
David Reed's user avatar
  • 93.2k
3 votes

Using Window.SessionStorage in product development cause any security vulnerability?

have seen few storages from salesforce Platform Cache and Session Cache, any idea how these works with security review and are these are replaceable for window.sessionStorage? Platform Cache is not a ...
sfdcfox's user avatar
  • 497k
2 votes

How to create trigger for DatedConversionRate object

I've found this piece, which allows to update CurrencyType by http request. The other answer allows to get sessionId for predefined user. With help of those and building comparison of two object, ...
Ilya Lepesh's user avatar
  • 4,125
2 votes

Did the session id value disappear from the workbench?

After summer'17, it's gone from Debug logs as well. System.debug(UserInfo.getSessionId()) prints SESSION_ID_REMOVED If you want to get session id, you can try printing this in VF page with {!...
Aditya Vijay's user avatar
  • 1,294
2 votes

Sandbox session gets confused across browser tabs

I use a Chrome extension called Multi-Login. It allows you to open a new tab with separate session data. It works for SF, social media sites, whatever you want. If I open a link from that session into ...
Aidan's user avatar
  • 13.8k
2 votes

Bulk API: using Workbench InvalidSessionId (Unable to find session id)

Session id should be in same row in workbench request headers. Please make sure login to developer session and try with this X-SFDC-Session:00D36000000qbjo!ARoAQKiXWkLN9KMUcrhH8J11saoMuhArYs8JiYpo....
Suresh Kandru's user avatar
2 votes
Accepted

Angular App deployed on salesforce - login with community user

In javascript declare a global variable somewhere: var sessId = "{!$API.Session_Id}"; Then use that variable in your Angular2 App.
Jesse Milburn's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible