[SalesForce] Salesforce URLs from an external application always redirect to login page, even when I’m logged in into Salesforce

Since a few weeks all of the Salesforce urls that are shown in our external web application redirect to the Salesforce login page, even if the user is already logged in into Salesforce.

The URLs that are shown in the application look like this:

https://domain.eu1.visual.force.com/apex/Opportunity?id=xxx

When clicking the url the users are redirected to:

https://login.salesforce.com/?ec=302&startURL=%2Fvisualforce%2Fsession%3Furl%3Dhttps%253A%252F%252Fdomain.eu1.visual.force.com%252Fapex%252FOpportunity%253Fid%253Dxxxx

Could this be a security setting of some sort?

Edit

If I copy-paste the same url directly into the browser, I don't get the login page

SOLVED

Issue found! Apparently our client changed servers/domain.
The old domain was:

domain–c.eu1.visual.force.com

The new one:

domain–c.eu4.visual.force.com

This is why we got redirected

Best Answer

Your redirect URL looks a bit odd. If I decode the query string I get:

  • ec=302
  • startURL=/visualforce/session?url=https%3A%2F%2Fdomain.eu1.visual.force.com%2Fapex%2FOpportunity%3Fid%3Dxxxx

It's like you are bouncing the request through /visualforce/session?. Why not just set the startURL directly to /apex/Opportunity?id=xxx?

Note that the startURL must be a relative URL.

For example, if I want the user to end up at:

https://dfb.na5.visual.force.com/apex/HelloMobile?sfdc.tabName=01r70000000UJnp

I send the browser to:

https://login.salesforce.com/?startURL=%2Fapex%2FHelloMobile%3Fsfdc.tabName%3D01r70000000UJnp

Note that I don't define the domain that the user will be logging into. Just the relative URL encoded for the query string.

If your external web application already has a valid Session then you could use the frontdoor.jsp to directly bypass the login page.

Related Topic