Bad Cookies after Upgrade to CF 10

I don’t know for sure, but I have a guess: I think this is one of those kind of problems that are fixed by your adding a jvm argument that turns off “session fixation” security, which was added to CF 10 added—and which was made available as well for CF 8 and 9, but perhaps you had not applied it (and experienced the impact of the fix, and the need to “turn this new protection off”) before you made the move to 10.

The argument (and a brief discussion of the issue) is mentioned in the technote http://helpx.adobe.com/coldfusion/kb/security-hotfix-coldfusion-8-8.html. As it notes, you can add:

-Dcoldfusion.session.protectfixation=false

By adding this in the JVM args for CF (whether in the CF admin Java & JVM page, or in the jvm.config) and restarting CF, you will indeed be turning this particular “improvement”, but if that improvement is what’s making your apps break, then this is indeed an idea of “what we can do short of forcing all of our users do manually delete all of their cookies.”

If you have someone with whom you can do a test, you should know fairly quickly whether it “fixes the problem”. I appreciate that the next natural question is “well, what do I then LOSE in terms of protection by applying this removal of protection?” That’s not well-discussed in that technote, but you can read about session fixation in general here: http://en.wikipedia.org/wiki/Session_fixation and https://www.owasp.org/index.php/Session_fixation.

And I’d note that this “addition of session fixation protection, with the option to turn it off” is not unique to CF. Here’s an article written for Tomcat users explaining it as well: http://www.tomcatexpert.com/blog/2011/04/25/session-fixation-protection, and even here’s one on asp.net: http://software-security.sans.org/blog/2009/06/24/session-attacks-and-aspnet-part-2

But back to your original question, I *hope* that this may be the quick and easy solution to your challenge. I didn’t want to just offer a one paragraph answer to give you (and other readers) additional perspective needed to appreciate the suggestion.

Let us know if it helps.

/charlie