如何验证Salesforce Apex REST API中的访问令牌？
大家好，
基本上，我是Salesforce的新手，我正在使用APE制作RET RETAPI。 有什么方法可以验证访问令牌， 我知道我们可以在组织中设置令牌到期的限制，但是如何从代码级别处理它？
示例
我的代币已过期，然后有什么方法可以处理它？目前是我的 执行未达到该方法似乎是Salesforce本身 投掷执行。
任何帮助将不胜感激。
Hi everyone,
basically, I'm new to salesforce, I'm making the rest API using Apex.
is there any way to validate the access token,
I know we can set up the limit for the token expiration in the org, but how to handle it from the code level?
For an example
My token got expired then is there any way to handle it? currently my
execution is not reaching to the method seems salesforce itself
throwing an execption.
any help will be highly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您正在编写
@RestResource等？在该代码中，您不必担心授权。如果代码运行 - Salesforce已经验证了会话ID，则找到了用户，并确认了该用户可以访问此类，则会话ID是使用良好的OAuth2范围等创建的，如果您是在谈论登录和登录的外部应用程序称此自定义服务 - 好吧。您需要选择正确的OAuth2流以登录用户（您将其标记为社区，因此“用户名密码流”不起作用，您可能需要“ Web Server Flow”或“用户代理流”。示例
最好的是防御性的代码。过程（如果您真的在社区中进行操作 - 将它们重定向到登录屏幕，并用回调URL指向您要执行的操作），请等待用户完成登录并重试操作？您可能会获得授权失败的原因有很多，请检查 https：//stackoverflow.com/a/a/72172172355/313628 for开始。
You're writing Apex code that's exposed as REST service, with
@RestResourceetc? In that code you don't have to worry about authorisation. If the code runs - Salesforce already validated the session id, found the user, verified that this user has access to this class, that the session id was created with good OAuth2 scope etc.If you're talking about external application that logs in and calls this custom service - well. You'd need to pick right OAuth2 flow to log the user in (you tagged it communities so "username password flow" for example won't work, you'll likely need "web server flow" or "user agent flow". For example this one returns "issued at" but it doesn't mean much, it doesn't automatically mean that session is valid for X hours. As user keeps interacting with the app the session timeout gets reset; on other hand an IP change could kick you out, admin could suspect hacking and kick you out using Setup -> Session Management...
Best you can do is code defensively. Make a request with last known session id you got, if it returns something like
401 Unauthorised- call login procedure (if you're really doing it in community - redirect them to login screen with callback url pointing back to the action you wanted to do), wait for user to complete login and retry the operation? There are many reasons you might be getting authorisation failure, check https://stackoverflow.com/a/72172355/313628 for start.