I've found that, in the wild, the

cfid

cookie, even when defined as a session cookie (which normally deletes when the browser closes), can actually live for weeks, depending on how a user uses their browser. I have reasons that I don't want those cookies to live that long and I'd like to do housekeeping. Can you think of any way to distinguish whether a

cfid

token is not associated with an existing session? I'd like to take the opportunity to delete that cookie in that case. I don't want Lucee to say, "okay, I'll just use this

cfid

token to create a new session with."

https://luceeserver.atlassian.net/browse/LDEV-3726 Ignoring

this.sessionCookie.timeout=-1

(which the docs say you can do) has been a bug for some time. Fixing it would make things so much simpler. In the meantime we set

this.setClientCookies=false

and write the cookies ourselves without the

expires

attribute.

hi @cfsimplicity, i think you're talking about setting session-type cookies, which is what we're already doing. if a user keeps their browser open for a month, that cookie will live for a month. i don't want that. let me put it a different way: what i want to do is, say, delete or overwrite the user's

cfid

cookie if it's not associated with a current session. as it is now, lucee will happily reuse a

cfid

from some ancient session and build a new session based on it. i don't want that. i want to get in the middle of that and either overwrite it with a brand new

cfid

or delete it. i can work out the details if i figure out a way to detect whether the

cfid

being passed by the user is a current session or not.

Sorry, you're right I misunderstood. But won't

sessionRotate()

do what you want? It will overwrite an existing cfid with a new value which then becomes the current session ID.

that's new to me, thanks. i'll read up on it...

setting cfid cookie manually should be a thing, just guessing ?

yeah, it can be done manually but what i don't know how to do is detect when it's appropriate to do that. i'd want to do it when the cfid doesn't match a current session. right now i don't know how to differentiate between that case and when lucee is offering up a cookie to a newcomer. when lucee is serving up a session cookie to a newcomer, the

cfid

cookie appears in the

cookie

scope during the request because it's about to send that cookie to the user. so it's hard to know whether that's an old

cfid

that the user is passing or whether it's a new one that lucee is offering.

https://luceeserver.atlassian.net/browse/LDEV-1105 Raised a long while ago… lucee will trust any cfid cookie sent to it and will happily start a session using that value. I was trying to counter this with a sessionrotate within onSessionStart