Details
Description
There are few cases where we show the sessionId in logs (using UtilHttp.getSessionId() in or HttpSessionEvent.getSession().getId()) in other places)
Despite we secured the log access at r1489461, I suggested on the dev ML a properties to opt in, false by default. I will apply as a lazy consensus.
Attachments
Issue Links
- is related to
-
OFBIZ-6872 Remove all sessionsIds put in URLs
- Closed