I am trying to retrieve the XML containing the list of Reports for my Organization using the document available at https://<server>.salesforce.com/servlet/ReportList.servlet

The way I'm retrieving this document from inside my VF controller is with this code:

Map<String, String> headers = ApexPages.currentPage().getHeaders();
String endpoint = 'https://' + headers.get('Host') + '/servlet/servlet.ReportList';
HttpRequest req = new HttpRequest();
req.setEndpoint(endpoint);
req.setHeader('Cookie','sid=' + UserInfo.getSessionId());
req.setMethod('GET');
Http http = new Http();
HttpResponse res = http.send(req);
reportBody = res.getBody();

parseReportXml(reportBody);
 

This works fine for an Unmanaged VisualForce page ... but when I deploy my VF page in a Managed Package, this breaks down. The issue is that when you access a managed VF page, there is a big long redirection dance that issues you new cookies (and a new Session ID) for the server that the VF page resides at. The URL you finally end up at is a force.com URL (ex. https://<package prefix>.<server name>.visual.force.com/apex/<my page>)

So, there are two issues:

1) The use of the headers.get('Host') is no longer correct (since I'm no longer at <server>.salesforce.com) ... I can work around that because SF actually gives me a Redirect response if I try to run the above code

2) The Session ID inside my VF controller is not a valid SessionID for the <server>.salesforce.com server. This is what I can't figure out a workaround for.

Is there some way to have SF issue me a SessionID via some API that would be valid for the <server>.salesforce.com based on the SessionID I have for the visual.force.com domain?

Thanks,

Dave