AppDeveloper-Sp9Jq0

Inspiring

Answered

HTTPOnly NOT working

Forum|Forum|16 years ago
January 8, 2010
2 replies
1316 views

Hi,

I have code in the onSessionStart event that prevents JavaScript from accessing the session cookies thru the use of "HTTPOnly" attribute in the <cfheader> tag, and everything's working. But once I started adding code that ends the session when the user closes the browser (see code below), the code that prevents JavaScript from accessing the session cookies NO longer works.

Does anybody have any solution for this?

Many thanks in advance.

<cffunction name="onSessionStart" output="false" returntype="void"> 
        <!--- Code that ends the session when user closes browser ---> 
        <cfcookie name="CFID" value="#session.CFID#" /> 
        <cfcookie name="CFTOKEN" value="#session.CFTOKEN#" /> 
                 
        <!--- HTTPOnly is a flag that tells the 
browser to only submit the cookie via HTTP requests, which means it cannot be access via JavaScript ---> 
        <cfheader name="Set-Cookie" value="CFID=#session.CFID#;HTTPOnly"> 
        <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;HTTPOnly"> 
 
       <cfreturn /> 
</cffunction>

This topic has been closed for replies.

Correct answer BKBK

Part of the Application.cfc

<cfcomponent>

<cfset this.setClientCookies="no">

<cffunction name="onSessionStart" output="false" returntype="void">
    <cfif isDefined("cookie.CFID")>
        
        <cfcookie Name="CFID" Value="#cookie.CFID#">
        <cfcookie Name="CFTOKEN" Value="#cookie.CFTOKEN#">
    <cfelse>
        
        
        <cflock Scope="Session" Type="Readonly" Timeout="5">
            <cfcookie Name="CFID" Value="#Session.CFID#">
            <cfcookie Name="CFTOKEN" Value="#Session.CFTOKEN#">
        </cflock>
    </cfif>

        
        <cfheader name="Set-Cookie" value="CFID=#session.CFID#;HTTPOnly">
        <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;HTTPOnly">

       
</cffunction>

</cfcomponent>

Community Expert

Correct answer

Community Expert

Part of the Application.cfc

<cfcomponent>

<cfset this.setClientCookies="no">

<cffunction name="onSessionStart" output="false" returntype="void">
    <cfif isDefined("cookie.CFID")>
        
        <cfcookie Name="CFID" Value="#cookie.CFID#">
        <cfcookie Name="CFTOKEN" Value="#cookie.CFTOKEN#">
    <cfelse>
        
        
        <cflock Scope="Session" Type="Readonly" Timeout="5">
            <cfcookie Name="CFID" Value="#Session.CFID#">
            <cfcookie Name="CFTOKEN" Value="#Session.CFTOKEN#">
        </cflock>
    </cfif>

        
        <cfheader name="Set-Cookie" value="CFID=#session.CFID#;HTTPOnly">
        <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;HTTPOnly">

       
</cffunction>

</cfcomponent>

Inspiring

AppDeveloper,

Why can't you turn on "Enable J2EE Session Management" through which you can achieve the same thing (i.e, making the session to expire when the user closes a browser window)?.

AppDeveloper-Sp9Jq0Author

Inspiring

Daverms,

Unfortunately, my company does not allow me to use J2EE Session Management. Any other solution?

Many thanks.

Inspiring

Please follow this blog, and see if anything help you...

http://www.bennadel.com/index.cfm?dax=blog:1631.view