@AbhishekKumar93

The data kept in local storage is needed for internal purpose of the application and access to it cannot be disabled. There is number of security settings and guides to prevent CSRF, XSS attacks and app should be appropriately secured before executing security tests.

See for the reference https://community.pega.com/knowledgebase/articles/security/security-checklist

Also, the Pega-RULES cookie is encrypted, for example I can see: pyRequestorTokenHYFF4ALKBCN9U4RU6IPKKX1U8RXP8W11RA:"1" but the cookie is: Pega-RULES:{pd}AAAAAclaODtWZjqGb4qe0gRP5MIigc+P49QoFiaBfGGzIXNsT/o361H6Rl/j1NRai4g4bw==A

Best practices to prevent it to happen can be found at Understanding cross-site scripting and related articles

If, however, you have identified the scenario where base on the RequestorID you can hijack the user session please contact our support team and we will investigate it further.