---
title: "Cross-Domain Session Information Is Exchanged Using A GET Request Instead Of A POST Request"
description: "Impact Area Security Severity Medium Affected Element Org Config ## Rule ID **SF-0164** ## Impact Session data is exposed when making cross-domain requests with GET requests. This is not the case with POST requests. ## Remediation Configure your Org to…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/cross-domain-session-information-is-exchanged-using-a-get-request-instead-of-a-post-request/"
updated: "2025-03-21"
category: Rules
---

# Cross-Domain Session Information Is Exchanged Using A GET Request Instead Of A POST Request

Impact Area

Security

           Severity

Medium

           Affected Element

Org Config

## Rule ID

**SF-0164**

## Impact

Session data is exposed when making cross-domain requests with GET requests. This is not the case with POST requests.

## Remediation

Configure your Org to use POST requests when making cross-domain calls as described [in this Salesforce documentation page.](https://help.salesforce.com/s/articleView?id=sf.admin_sessions.htm&type=5#:~:text=site%20home%20page.-,Configure%20Secure%20Connections%20(HTTPS)%20Settings,-By%20default%2C%20Salesforce)

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-1021 Improper Restriction of Rendered UI Layers or Frames](https://cwe.mitre.org/data/definitions/1021.html).