Hello, We recently ran a Health Check and one of the items in there was to turn on - Require HttpOnly attribute. I read a lot of documentation and other available blogs that state 99% of the time it should be good to enable it. Obviously we would do that in a full sandbox and test things out, but I wanted to ask folks here if there are any known issues or caveats we should be aware of and look for them first. We have a ton of managed packages in the organization.
Thank you so much!
4 réponses
The Developer Console is not available if the Require HttpOnly attribute is selected. That is the main drawback. Some VisualForce pages rely on Javascript getting the session token from the cookie and this will also fail.
