Anyone have a working example of the line of code one needs to add in order to set the CFTOKEN and CFID cookies with a SameSite attribute of 'Strict' or even 'Lax'? Adobe's example is for the <cfapplication> tag, which we do not use. Here are some versions we tried at the top of our Application.cfc function, under all the

this.Name

and

this.ApplicationTimeout

stuff. Yes, restarted the service for each one of these: •

<cfset this.authcookie = {samesite = 'Strict'} />

•

<cfset authcookie = {samesite = 'Strict'} />

•

<cfset this.authcookie.samesite = 'Strict' />

•

<cfset authcookie.samesite = 'Strict' />

Also, this documentation confused me a little bit. Should this be "Strict"??:

i don't have one, but would try setting using a struct in your examples above i.e.

{samesite:'Strict'}

Good catch, although I'm just working off their own doc here

good point

ACF 2021,0,15,330303

internet search says you can use GetCookie function to get the CFID and CFTOKEN cookies and then declare them again with samesite prop, ex:

<cfscript>
    // Set CFID cookie
    cookie.CFID = GetCookie("CFID"); // Retrieve the existing value if set
    SetCookie(
        name="CFID",
        value=cookie.CFID,
        httponly=true,
        secure=true, 
        samesite="Strict"
    );

    // Set CFTOKEN cookie
    cookie.CFTOKEN = GetCookie("CFTOKEN"); // Retrieve the existing value if set
    SetCookie(
        name="CFTOKEN",
        value=cookie.CFTOKEN,
        httponly=true,
        secure=true, 
        samesite="Strict"
    );
</cfscript>

Hmmm, so everyone else knows that Adobe's full of crap on this one? I'm SHOCKED! 😉

lol, we do what we gotta do

Yep. I'll just add this to my list of "reasons to Lucee" that I give to clients. I appreciate you jumping in tho, thanks.

it takes a village, your welcome, hopefully that works. (ya i was on ACF for the first 10 years, lucee for the last 10)

Isn't authcookie for

cflogin

?

I found the following 4 possibilities in the Adobe ColdFusion documentation: (1) Samesite setting In the so-called pseudo-constructor area of Application.cfc:

<!--- CFAuthorization cookie: this.authcookie is a struct with possible keys currently 'disableUpdate', 'timeout', 'samesite' --->

<cfset theAppAuthCookie=structNew()>

<cfset theAppAuthCookie.samesite="strict"> <!--- Options: Strict, Lax or None --->

<cfset this.authCookie=theAppAuthCookie>

<!--- Session cookie: this.sessioncookie is a struct with possible keys currently 'disableUpdate', 'timeout', 'httponly', 'secure', 'domain', 'samesite'  --->

<cfset theAppSessionCookie=structNew()>

<cfset theAppSessionCookie.timeout=createTimeSpan(0, 1, 0, 0)>

<cfset theAppSessionCookie.samesite="strict"> <!--- Options: Strict, Lax or None --->

<cfset this.sessionCookie=theAppSessionCookie>

(2) Equivalently, in Application.cfm:

<!--- Authorization cookie --->

<cfset theAppAuthCookie = {samesite='strict'}> <!--- Options: Strict, Lax or None --->

<!--- Session cookie --->

<cfset theAppSessionCookie.httponly=true>

<cfset theAppSessionCookie.timeout=createTimeSpan(0, 1, 0, 0)>

<cfset theAppSessionCookie.samesite="strict"> <!--- Options: Strict, Lax or None --->

<cfapplication

name="theApp"

sessionManagement="yes"

authCookie=theAppAuthCookie

sessionCookie=theAppSessionCookie>

(3) Cookie's samesite attribute to instruct the browser on how to handle a cookie in first-party or third-party situations:

<cfcookie name="cookieName" samesite="strict"> <!--- Samesite options: Strict, Lax or None --->

(4) Implement samesite as CookieProcessor attribute in Adobe ColdFusion's context.xml configuration file:

<Context>

<!-- Either the sameSiteCookies attribute is not set, or else it is set with value none, lax or strict -->

<CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" sameSiteCookies="strict"/>

</Context>

This makes use of an implementation of Tomcat's Legacy Cookie Processor.

Are people still using Application.cfm? That was deprecated in (I think) ColdFusion 7 - that's 20 years ago!

@aliaspooryorik: Are people still using Application.cfm?

You will be surprised. 😀

Sadly, I'm probably not surprised - it's more a feeling of eye roll 😞 🤦 !

i work on an active codebase that is that old - none of the other engineers ever saw any compelling reason to change it

any compelling reason to change it You answered your own question though - an active codebase 🙂 If it's an active project it should be maintained (which includes modernisation, regressions tests etc as well as new features), simple as that