cfml

Is setting the Secure flag on an HTTPS in ColdFusion 2023 still a  matter of editing and configuring the \cfusion\runtime\conf\web.xml file?

<session-config>
       <session-timeout>30</session-timeout>
   </session-config>
with the setting
<session-config>
    <session-timeout>30</session-timeout>
    <cookie-config>
         <http-only>true</http-only>
         <secure>true</secure>
     </cookie-config>
</session-config>

Another option is to do this in the application with `this.sessionCookie.secure = true`. I don't think you can do this with cfsetup. If you can, it isn't very obvious.