Impact area

Security

Severity

Medium

Affected element

Org Config

Rule ID #

SF-0169

Impact #

Allowing code access the Session ID cookie increases the vulnerability to session hijacking attacks.

Remediation #

Enable this setting. From Setup, enter “Session Settings” in the Quick Find box, then select Session Settings. Then enable “Require HttpOnly attribute”.

Time to fix #

30 min

References #

This rule is linked to Common Weakness Enumeration CWE-284 Improper Access Control.