httponly cookie

Remove the word "secure" for any of your CFHEADER values. Unless you are running on an SSL connection (which I am suspecting you are not) then *exactly* what you are describing will happen.

When you have the word "secure" in the SET-COOKIE header it sets the cookie as a SECURE cookie. This means the browser will NOT send the cookie to the server unless it is over an SSL connection.

Jason

I recommend that you use JSESSIONID instead of CFID and CFTOKEN by enabling J2EE session management in the CF Administrator. Then, do this:

http://www.12robots.com/index.cfm/2009/5/6/Making-the-JSESSIONID-Session-Token-Cookie-SECURE-and-HTTPOnly-and-settings-its-PATH

Dave Watts, CTO, Fig Leaf Software

4 suggestions:

1) Make sure the name of your application file begins with capital-A, thus: Application.cfm;

2) Define timeouts for the application and for sessions;

3) Remove the if-condition on CGI.HTTPS, as it is unnecessary.(The code within the if-block is the same as that within the else-block);

4) Set the cookie expiry date.

<cfapplication  name="bsnew" applicationTimeout="#createTimespan(1,0,0,0)#" clientmanagement="Yes" sessionmanagement="Yes" sessionTimeout="#createTimespan(0,0,20,0)#" setclientcookies="no" scriptprotect="All">

<!--- cookie set to expire 1 day later --->

<cfset session.cookieExpiryDate=dateAdd("d", 1, now())>

<cfif NOT (isDefined("COOKIE.CFID") AND isDefined("COOKIE.CFTOKEN"))>

    <cfheader name="Set-Cookie" value="CFID=#session.CFID#;expires=#getHttpTimeString(session.cookieExpiryDate)#;secure;HTTPOnly">

    <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;expires=#getHttpTimeString(session.cookieExpiryDate)#;secure;HTTPOnly">

</cfif>