Cause

Users receive the following error message when launching Composer: "Invalid Session or your session has expired. (Lock IPs may be enabled.)" This error occurs when the "Lock IP Address" setting is enabled or when launching a non-OAuth button in Lightning.

What to Do

  • Disable the "Lock IP Address" setting for hosted AppExchange applications.
    1. Navigate to Salesforce Setup > Administration Setup > Security Controls > Session Settings.
    2. Ensure that the "Lock sessions to the IP address from which they originated" field is NOT checked.
    3. Click Save.
  • Convert your non-OAuth buttons to OAuth buttons for Lightning.
  • You must RESTART all instances of the browser for the setting to take effect.