Fix Salesforce auto refresh being at odds with Salesforce recommended best security practice: enabling 'Require HttpOnly attribute' breaks auto-refresh for lists in Console
The auto-refresh functionality for Listviews in the Service Console is a very useful and heavily used functionality for our customers.
In an attempt to reduce security risks and comply with Salesforce's security standards, we ran a Health Check (available under Setup-> Security). This tool classifies 'Require HttpOnly attribute' as a Critical High-Risk Security Setting.
Much to our surprise we found out that enabling it actually breaks the auto-refresh functionality.
This is also documented here: https://help.salesforce.com/articleView?id=console2_push_notifications.htm&type=5
We would like to both comply with security recommendations and at the same time keep using all of the standard functionality.
if you prefer using an app, an alternate is to use the Salesforce List view Auto Refresh browser extension (install here). It lets you configure refresh intervals for individual list views in hh:mm:ss. The list view will auto refresh after the configured interval. It is user friendly and easy to use.
