A-1410 Never set session lifetime or idle time to 0 (unlimited).
Reason
Leaving the session lifetime or idle time at 0 means sessions never expire. An abandoned browser then keeps an authenticated session open indefinitely, increasing the risk of session hijacking on shared or unattended machines.
Set both limits to sensible non-zero values under Shared Components → Security Attributes → Session Management.
Examples
Non-Compliant Example
app CUSTOMERS (
// ...
sessionManagement {
maxSessionLength: 0
maxSessionIdleTime: 0
}
// ...
) | Line | Column | Message |
|---|---|---|
| 4 | 27 | maxSessionLength must not be set to 0 (unlimited). |
| 5 | 29 | maxSessionIdleTime must not be set to 0 (unlimited). |
Compliant Solution - ★★★★☆
app CUSTOMERS (
// ...
sessionManagement {
maxSessionLength: 604800
maxSessionIdleTime: 86400
}
// ...
) Compliant Solution - ★★★★★
app CUSTOMERS (
// ...
sessionManagement {
}
// ...
) Omitting values applies INTERNAL / Workspace defaults
Tests
Test SQL query
select workspace || '.' || alias as identifier,
'App ' || alias || ' in ' || workspace
|| ' has an unlimited (0) session lifetime or idle time.' as message
from apex_applications
where (maximum_session_life_seconds = 0 or maximum_session_idle_seconds = 0)
and workspace in (#ApexWorkspaces#)
and (json_value(json_array(#ApexAppIds#), '$[0]') is null
or json_exists(json_array(#ApexAppIds#), '$[*]?(@ == $id)' passing to_char(application_id) as "id"))Test results
| Identifier | Message | Migration |
|---|---|---|
| WORKSPACE.CUSTOMERS | App CUSTOMERS in WORKSPACE has an unlimited (0) session lifetime or idle time. | - |
Parameters
Use parameters to customize the rule to your needs.
| Parameter | Description | Default Value |
|---|---|---|
| ApexAppIds | Comma-separated list of APEX application IDs to check. If empty, all applications of the workspaces are checked. | , |
| ApexWorkspaces | Comma-separated List of APEX workspaces owning APEX applications to check. | dblinter, dbl_gui |
References
- same as UC-1410