Is it possible to reset jsessionid?

[genadi_mak]

Hi,

We have new requirement from security department to reset jsessionid after a user resets his password.

I tried to reset it with this statement <cfcookie name="jsessionid" value="#VARIABLES.RandomID##cookie.jsessionid#" domain="#REQUEST.Site.Domain#" httponly="true" secure="yes">

But, this created a second jsessionid.

CF2016

Thank you,

Gena

[Dave Watts]

This cookie is set by Tomcat, not by CF really. It's a session cookie, and you can't just create a new one from CF. It uses a system-generated UUID, and you can't just put whatever value you want in there. You should be able to expire the current one with CFCOOKIE, though, and Tomcat will automatically set a new one on the following response to the request without a session cookie.

Dave Watts, Fig Leaf Software

[genadi_mak]

Hi Dave,

I did this

<cfcookie secure="yes" name="JSESSIONID" value="" domain="#REQUEST.Site.Domain#" expires="now" httponly="true">

Then, refreshed and the cookie did not change.

Thanks

[Dave Watts]

I would try removing the VALUE attribute, and maybe all the other attributes except the EXPIRES attribute. If none of those combinations work, you might have to see how Tomcat controls this and look at changing the Tomcat configuration in its own configuration files (context.xml etc in /cfusion/runtime/conf).

Dave Watts, Fig Leaf Software

[Dave Watts]

Actually, even better:

https://osric.com/chris/accidental-developer/2014/07/coldfusion-session-fixation-and-jsessionid/

Dave Watts, Fig Leaf Software

[BKBK]

genadi_mak  wrote

We have new requirement from security department to reset jsessionid after a user resets his password.

Why get involved with the session apparatus every time users reset their password? Imagine having to tinker with the engine every time a driver gets in or out of a car! A neater solution is to decouple driver permission from the workings of the engine.

This analogy suggests one way to solve your problem.

1) Enable the use of JsessionId in the ColdFusion Administrator;

2) Use the cflogin framework - including cflogout - to log users in and out;

3) In Application.cfc, set the value of the loginStorage attribute to "session".

That's it. It is tight in security terms, and quite convenient, too. You don't have to worry about the sessionId.

When the user is logged in, then

• session.cfauthorization_yourApplicationName exists
• getAuthUser() returns the username (with which ColdFusion logged the user in, for example, by means of cfloginuser)
• isUserLoggedIn() returns Yes

When the user is logged out, then

• session.cfauthorization_yourApplicationName does not exist
• getAuthUser() returns an empty string
• isUserLoggedIn() returns No