AGENTFORCE-VF-04: Visualforce Session ID Exposure
🔴 High · Credential Exposure
Detects Visualforce pages that render {!$Api.Session_ID} or {!GETSESSIONID()}. High when the session id is sent to a non-Salesforce host (session harvesting); medium when it is only rendered into the page, where any injected script can read and replay it.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-VF-04 |
| Severity | High |
| Category | Credential Exposure |
| Compliance | SOC2_CC6, PCI_DSS |
Remediation
Do not put the session id in markup. Call Salesforce APIs from Apex (or use Lightning Data Service / the AJAX toolkit's same-origin session), and reach external services through a Named Credential so the browser never holds a token. If a third party needs to call Salesforce, use an OAuth connected app with scoped tokens instead of forwarding the user's session.