Users receive the following error message when launching Composer: "Invalid Session or your session has expired. (Lock IPs may be enabled.)"
This error occurs when the "Lock IP Address" setting is enabled or when launching a non-OAuth button in Lightning.
What to do
Disable the "Lock IP Address" setting for hosted AppExchange applications.
- Navigate to Salesforce Setup > Administration Setup > Security Controls > Session Settings.
- Ensure that the "Lock sessions to the IP address from which they originated" field is NOT checked.
Convert your non-OAuth buttons to OAuth buttons for Lightning.
You must RESTART all instances of the browser for the setting to take effect.