is there a way to hide session id parameter in the URL of an org? Here, an example:
I think that is a big security problem, both because a browser can cache session information in the url or intercept/log by other network devices and also because in the logout phase the session is not destroyed on the server, providing a way to perform client-side attacks. Also, if a user logs out and then does not close the browser, another user accessing the same computer could easily resume the first user’s session without the need for authentication.
Is it possible to fix or mitigate the above critical observations?
