Derek never replied before now, of course. If he does not offer a solution in reply to you, I hope you'll at least consider what I wrote to him above.  And is your situation exactly his? I'm gathering you got the same error message, which is perhaps how you found this post.

If so, did you uncheck "Disable updating Coldfusion internal cookies using Coldfusion tags/functions"? What happened then? He says he got a hanging request after that. Are you also? As we never heard more, perhaps that had a different explanation (maybe once his code got past that cfcookie that was failing, it hung up on something else unrelated to this issue)?

Or have you not yet made that setting change, perhaps in fear that it won't solve this error message? It will, and the only negative consequence is that you're disabling a protection Adobe has offered (in that setting) since cf10. It's about protecting modification in code of these specific CFID/CFTOKEN and/or JSESSIONID cookies, used for CF session management.

(That said, the option to disable that is checked by default only if one enables the "secure profile" feature at cf installation or via another page in the cf admin. Of course, someone can change the setting itself as discussed above.)

But let's take a different approach to your (and their) problem; folks who are doing that cfcookie--setting cfid and cftoken to have no expires attribute--are doing that to cause an effect that the cookie goes away when the browser is closed. That's a security protection they want (or someone in the past wanted).

Well, note that this can be achieved (without your code touching the cookie) by using ANOTHER setting at the bottom of that same memory variables page: setting "cookie timeout" to - 1. Sadly, it's not indicated there and its barely documented.

Or--if you can't or don't want to do that change at the cf admin level (which affects all apps on the server), you can also effect that change at the application level, whether in cfapplication (application.cfm) or application.cfc. You can also control that ability to disable the cf session cookie updates. The docs have examples of doing it in application.cfc, but they don't show doing it in application.cfm and with cfapplication. Here is one example that could work for you:

<cfapplication sessionmanagement="yes" sessioncookie="#{timeout="-1",disableupdate="no"}#">

<!--- this example shows setting only the least attributes needed to demonstrate this issue. You may need to add more attrbutes for your app, of course, such as sessiontimeout. Or you may need to add more struct keys for the sessioncookie. Also, FWIW, the sessioncookie value above could be written  without quoted values as {timeout=-1,disableupdate=false} --->

Note also that you can prove that you've effected the change by doing this:

<cfdump var="#getapplicationmetadata().sessioncookie#">

which will show what settions are set for the various aspects of this sessioncookie struct.

In fact, you may want to do that first WITHOUT the change above, to see what your sessioncookie settings are by default. You would then want to consider whether to set those other cookie settings as well. Note the sessioncookie attribute simply takes a struct of keys, which again are documented by Adobe here, though they show using the sessioncookie only in application.cfc instead.

All that said, if you DO find tht setting the cookietimeout is sufficient for your needs, then you may want to NOT change that disableupdate feature, as again it's "true" for your protection. But at least this lets you control things at the app level.

Let us know if any of this gets you going, Derek, or at least I hope it may help future readers of this page.