Background:
Our application overrides the tab for an custom object with a Visualforce page.

The tab URL itself is set by salesforce & always goes to the "/servlet/servlet.Integration" page provided by salesforce.  A series of redirects takes place and the user is eventually redirect to our app's Visualforce domain (https://i.xyz.visual.force.com/apex/aaPendingAddrs).

Bug:
In the past week or so, something has broken in this redirect sequence.  Specifically, logging into to multiple salesforce instances no longer works.  Once you have visited a Visualforce page in one instance, you have to completely close your browser before you can use a Visualforce page on another instance.  Using the "logout" functionality does not work - you must completely close all browser windows.

It appears that salesforce is setting a session-length cookie in the global ".salesforce.com" domain that holds which instance should serve your Visualforce pages.  This behavior is new, and has severe consequences.  We've gotten a lot of customer calls, and we've seen problems crop up strangely multiple times.

I spent some time this morning documenting what I could find.  I doubt the bug is restricted solely to tabs-overriden-with-Visualforce-pages .. this probably happens whenever Visualforce pages are used.

The bug strikes in a variety of ways.  In my examples below, I first logged into an EE instance on NA4 and then logged into an EE "test edition" org on NA5.  If you watch the AVI's carefully, you will see the URL change unexpectedly from one instance back to the other.

1.  Login to instance 1 (na4), go to Visualforce page, then login to instance 2 (na5), then go to the Visualforce tab.  Salesforce will try to redirect to an incorrect (non-namespaced) URL in instance 1 (na4):

Here are AVIs of the bug in Firefox, IE, and Chrome.

Here's a snapshot of the error screen:

Here's a snapshot of Firebug (Firefox dev. plugin) tracing the redirect from na5 to na4:

2.  Similar to above, but try to be a good citizen and "logout" between logins:  Login to instance 1, go to Visualforce page, logout, login to instance 2, go to the visualforce tab.  Salesforce will launch into an infinite redirect loop that ends with an error being displayed to the user (exactly which error depends on the browser).


Here are AVIs of the bug in Firefox, IE, and Chrome.

Here's a snapshot of the "infinite loop" message in firefox:

3.  Depending on the sequence of clicks, you can also get a situation where no visible error occurs BUT when you click to a Visualforce page on one instance, you actually end up in the other instance.  This might be the worst way that the bug strikes, because you are silently in the wrong build!

Here's an AVI of that happening in Firefox.  I use two tabs (one in each instance) to show the sequence of clicks.  Note the first tab (na4) ends up at na5 when I click the "Emails" tab!