We have 2 new CF 2021 servers.
Secure Cookie and H...
# adobed
Dave Merrill
08/22/2022, 1:30 PMWe have 2 new CF 2021 servers.
Secure Cookie and HTTPOnly are checked in CF admin on both.
However, on both servers, we see that those settings are applied to JSESSIONID, but not to CFID or CFTOKEN.
We do have Use J2EE session variables checked.
Does that mean that CFID and CFTOKEN aren't used at all, so it doesn't matter that they're not encrypted?
I bet we'll get dinged for it on our next security audit though.
Is there some way to make those two secure too?
p
Patrick
08/22/2022, 1:38 PMJust go ahead and add this to your application.cfc:
this.sessioncookie.secure = true;d
Dave Merrill
08/22/2022, 1:46 PM@Patrick Thanks, I'll check it out.
Do you know if my guess that it doesn't actually matter if you're using jsessionid is right?
p
Patrick
08/22/2022, 1:53 PMYou should just secure them all regardless; for security sake.
d
Dave Merrill
08/22/2022, 1:53 PM@Patrick
That doesn't seem to be working for me.
The application.cfc file I added that to is definitely running, but cfid and cftoken cookies are still not httpOnly or secure.
What version of cf are you in?
p
Patrick
08/22/2022, 1:59 PMDid you restart the application?
m
Michael Schmidt
08/22/2022, 2:03 PMTry deleting your existing cookies and then accessing it again...
d
Dave Merrill
08/22/2022, 2:03 PMno, but that's never needed for application.cfc changes except startup methods afaik.
what does that even mean? restart the server?
Dave Merrill
08/22/2022, 2:05 PM@Michael Schmidt That did it, thanks. Now all I have to do is to get every user to do that 😉
Seriously though, these are session cookies, so by the time anyone cares they'll have expired anyway.
r
Rodney
08/22/2022, 3:22 PMYou can set
this.clientManagement = falsethis.setClientCookies = falsed
Dave Merrill
08/22/2022, 3:22 PMHow do you tell CF that session cookies should be actual session cookies, so they expire when you close the browser, like the jsessionid cookie does?
r
Rodney
08/22/2022, 3:23 PMCF only uses the JSESSIONID when set to J2EE.
d
Dave Merrill
08/22/2022, 3:49 PMwe don't need client variables, but of course we do need session variables. client variables are shut off, but cfid and cftoken cookies are still getting created. they also expire in the length of time set in cf admin, but I don't see how to make them expire when you close the browser.
@Rodney CF might only USE jsessionid, but the other two are still getting created, so they'll get noted in a security audit.
Dave Merrill
08/22/2022, 3:50 PM@priyank_adobe @Mark Takata (Adobe)
Any comments?
Dave Merrill
08/22/2022, 4:28 PMApparently if you set Cookie Timeout to -1 minutes, then CFID and CFTOKEN become session cookies, which expire when you quit the browser. However, I assume that means they DON'T expires UNTIL you quit the browser, not ideal.
Is there any way to have them expire in 20 mins (say), OR when you quit the browser?
I'm seeing inconsistent results about them getting the secure and httpOnly attributes. Earlier they weren't present, but now they are. I've cleared them both, twice, between retests. I don't understand.
3 Views