We're on a Magento 184.108.40.206 and our Aperia ASV scan is failing because of Session ID in URL.
One example would be the following
matched: Session ID found in the URL.
A session ID is present in the URL. Passing the session ID in the URL is insecure as it may aid an attacker to obtain a valid session ID of a victim or to session fixation exploits.
They're asking for official Magento documentation about the
SID param in the URL but I can not find any.
How can I resolve this vulnerability?