Use of Session IDs in Visualforce
Why is this an issue?
Session IDs are sensitive credentials that allow API access on behalf of the user. Exposing session IDs in Visualforce pages or components creates security risks:
Session IDs in page source can be captured by attackers
JavaScript can access and transmit session IDs to malicious servers
Session hijacking becomes possible
Examples
Examples of incorrect code:
<apex:page>
<script>
var sessionId = '{!$Api.Session_ID}';
// Session ID now exposed in client-side code
</script>
</apex:page>
<apex:iframe src="/apex/myPage?sid={!GETSESSIONID()}"/>
Example of correct code:
<apex:page controller="MyController">
<script>
// Use Apex remoting instead of session IDs
Visualforce.remoting.Manager.invokeAction(
'{!$RemoteAction.MyController.getData}',
function(result, event) { /* handle result */ }
);
</script>
</apex:page>
How can I fix violations?
Use Apex remoting: Call Apex methods that make API calls server-side.
Use Named Credentials: For callouts, use Named Credentials instead of session IDs.
Use Lightning components: Migrate to Lightning where session handling is more secure.
Limit exposure: If session ID is required, minimize its exposure and use it only server-side.
When should I disable this rule?
You should rarely disable this rule. If session ID access is truly required, ensure it's handled securely and the page is protected by appropriate security controls.
Resources