1

is there a way to hide session id parameter in the URL of an org? Here, an example:

https://my-special-org.cs66.force.com/WebApp/secur/frontdoor.jsp?sid=00Z3O000000TVmy%21APDFESrve6Ry2gySd5EW_MOwGq4Q.bZhBAAGlmerk7_fgdg_gfdsgdfAk3WPDXkTCJjhJKkhFGjKSFZ9OeOCu

I think that is a big security problem, both because a browser can cache session information in the url or intercept/log by other network devices and also because in the logout phase the session is not destroyed on the server, providing a way to perform client-side attacks. Also, if a user logs out and then does not close the browser, another user accessing the same computer could easily resume the first user’s session without the need for authentication.

Is it possible to fix or mitigate the above critical observations?

2
  • A similar question but doesn't have any answer. Community please provide any information available. – Mr.Frodo Oct 15 '18 at 9:20
  • frontdoor.jsp is even used to log in into salesforce. See this article. – Mr.Frodo Oct 15 '18 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.