![active_sessions_list.png](https://lab.nexedi.com/nexedi/gitlab-ce/-/raw/383490a31376eb1bc6eb0617a454d1721c9280a1/doc/user/profile/img/active_sessions_list.png)
-
Imre Farkas authored
Session ID is used as a parameter for the revoke session endpoint but it should never be included in the HTML as an attacker could obtain it via XSS.
038d5305
![active_sessions_list.png](https://lab.nexedi.com/nexedi/gitlab-ce/-/raw/383490a31376eb1bc6eb0617a454d1721c9280a1/doc/user/profile/img/active_sessions_list.png)
Session ID is used as a parameter for the revoke session endpoint but it should never be included in the HTML as an attacker could obtain it via XSS.