Lucee's https://docs.lucee.org/reference/tags/location.html docs should specify what the default behaviour for the

addtoken

attribute is, yeah?

wanna update the tag definition here ?https://github.com/lucee/Lucee/commit/097d785419149844fdc0ab8290c726c946f36c7e

OK so it defaults to

false

? My reading of CF's docs is that on CF it (mostly) defaults to

true

:

HISTORY

ColdFusion 11: The addToken attribute is modified. If Secure Profile is enabled, addToken's default value will be "false".

I couldn't remember; and I had some vague recollection it used to be

true

- and that was almost always not what anyone wanted - so that it changed. Ages ago. But I really couldn't remember and it's not a tag I use very often. I only mostly trust CF's docs to be correct. Unless shit has changed and they couldn't be arsed updating them (which is too frequently the case for me to definitely back the docs over my hazy recollections).

Breaking change for Lucee 6, default is now secure

OK, so currently the default is

true

?

yep, the change was proposed, discussed and implemented https://luceeserver.atlassian.net/browse/LDEV-3437