We're on a Magento and our Aperia ASV scan is failing because of Session ID in URL.

One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384
Payload: N/A
matched: Session ID found in the URL.

A session ID is present in the URL. Passing the session ID in the URL is insecure as it may aid an attacker to obtain a valid session ID of a victim or to session fixation exploits.

They're asking for official Magento documentation about the SID param in the URL but I can not find any.

How can I resolve this vulnerability?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.