No rule selected
A-1410 – Never set session lifetime or idle time to 0 (unlimited).
Leaving the session **lifetime** or **idle time** at `0` means sessions never expire. An abandoned browser then keeps an authenticated session open indefinitely, increasing the risk of session hijacking on shared or unattended machines. Set both limits to sensible non-zero values under **Shared Components → Security Attributes → Session Management**.
Tags: All APEX versions, APEX_APPLICATIONS.
Quality area: Security. Severity: Critical. Fixing time: Local-easy.
Press p or n to quickly navigate to the previous/next rule.