Prevent Unauthorized used of session ID

Rule ID

SF-0169

Impact

Allowing code access the Session ID cookie increases the vulnerability to session hijacking attacks.

Remediation

Enable this setting. From Setup, enter "Session Settings" in the Quick Find box, then select Session Settings. Then enable "Require HttpOnly attribute".

Time to fix

30 min

References

This rule is linked to Common Weakness Enumeration CWE-284 Improper Access Control.