Skip to main content
F
Ferger
Participant
April 24, 2018
Question

securing the cfglobal cookie

  • April 24, 2018
  • 1 reply
  • 901 views

Our company was doing security scans on our https website and reported to me that the cfglobal cookie is not being served securely.  I did some reading and tried the following solutions to fix this.  After checking the headers I still have an unsecured cfglobal cookie.  Here's what I tried:

  1. CF Administrator -> Memory Varialbles -> Check Secure Cookie and HTTPOnly
  2. in Application.cfc added the following cfscript code:
    • this.sessioncookie.httponly = true;
    • this.sessioncookie.secure = "true"

Header:

I don't know what else to do.  I thought checking secure cookie in CF Administrator forces all the cookies to be served securly???

This topic has been closed for replies.

1 reply

pete_freitag
pete_freitag
Participating Frequently
August 31, 2018

If you do not use client variables then the CFGLOBALS cookie is not required, so if that is the case make sure you have clientManagement set to false in your Application.cfc or cfm.

There is not a setting a CF that adds the secure flag to the cookie so you can use your Web Server to modify the cookie value, here's an example of how to do that using IIS: https://www.petefreitag.com/item/850.cfm

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices