Hi @Steven Lawrance

We are participating in the pilot with a customer, and I want to thank you for the great work.

We probably found a bug in session handling in a customer community (using B2B Commerce). We are only able to reproduce it when the custom domain is enabled for the community. 

Steps to reproduce it:

1. login in to the community (either by using SSO using an OpenID Connect Auth Provider or Login As on contact) --> we are logged in, everything (also remote actions) work well
2. export session cookie "sid"
3. remove all cookies
4. reload the page --> not logged in anymore
5. import session cookie "sid"
6. reload the page 
   • without custom domain: logged in again. everything working (also remote actions)
   • with custom domain: not logged in, remote actions throw error "Remoting request invalid for your session.  Refresh the page and re-submit request" - even a reload doesn't help to recover. Removing session cookie sid helps.

The same also happens if you only modify the session cookie instead of removing and importing it.

I am also not able to reproduce this behavior on production with a custom domain enabled.

As this is very technical to reproduce the behavior, it often happens with normal user behavior browsing the community. 

I hope you can help me.

Thanks.

Thomas