Clayton

Session IDs should be treated as secrets and handled with care, as they may allow access to the Salesforce API on behalf of the running user.

[Salesforce] <a href="https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_variables_global_api.htm" target="_blank" rel="nofollow noopener noreferrer">$Api</a>

[CWE] <a href="https://cwe.mitre.org/data/definitions/807" target="_blank" rel="nofollow noopener noreferrer">Reliance on Untrusted Inputs in a Security Decision</a>

[OWAS] <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" target="_blank" rel="nofollow noopener noreferrer">Identification and Authentication Failures</a>

- [Salesforce] <a href="https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_variables_global_api.htm" target="_blank" rel="nofollow noopener noreferrer">$Api</a>
- [CWE] <a href="https://cwe.mitre.org/data/definitions/807" target="_blank" rel="nofollow noopener noreferrer">Reliance on Untrusted Inputs in a Security Decision</a>
- [OWAS] <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" target="_blank" rel="nofollow noopener noreferrer">Identification and Authentication Failures</a>

Detect uses of GETSESSIONID() or $API.Session_Id in Visualforce.

Use of Session ID in Visualforce

Home

Find answers and get help from Intercom Support and Community Experts

Empty Help Center

Uh oh. That page doesn’t exist.

Disappointed

Neutral

Smiley

Title

Track the progress of all tickets related to your company.

Tickets portal.

{assigneeName} needs more information from you

Rationale

Scope

Related resources