J2EE Checked - but still have CFID & CFTOKEN Cookies?

[csgaraglino]

Hello all, I am trying to work through this PCI thing and I have everyting set properly per Adobe - but I am still getting a fail because of prediciptable cookies. Here is what I am confused about: This article (http://kb2.adobe.com/cps/404/kb404762.html) says that J2EE replaces CF_ID and CF_TOKEN - but my server is generating a CFID and CFTOKEN (No Underscores) anyway? With J2EE checked, why are these cookies even being set? How do I get rid of them - they are why my PCI is failing?

[12Robots · Accepted solution]

Add this.setClientCookies="false" to your Application.cfc or srtClientCookies="false" to you <cfapplication> to tell ColdFusion not to set those cookies.

NOTE: I hope you are not using client variables.

[csgaraglino]

Will that terminate the ability to use "ANY" cookies? We use coockies in a verity of different way for ad tracking, subscription tracking, etc.

[12Robots]

Oh and NO that will not prevent you from using any cookies, it is just telling ColdFusion not to set cookies for use with the client scope, which is why those cookies are still being set.

Jason

[csgaraglino]

I think they may have been left-overs. I deleted my history again, close my browser and rebooted - and now your susgestion has worked and I am not able to get them back! So just to make sure I am clear on what I did, setting setclientcookies="no" only affects any code that is looking for the CFID or CFTOKEN directly? If I do NOT make a call to CFID or CFTOKEN I should not be affected anywhere, correct?

[12Robots]

setClientCookies=false simply tells ColdFusion not to set those cookies. I don't knwo that I woudl say that it "affects any code".  If you are ever looking for those cookies in code then Yes that code would not work. But I cannot imagine why anyone would ever look for those cookies anyway.

[csgaraglino]

Thanks again - none of my code looks for CFID or CFTOKEN in cookies, session or anywhere for that fact! So far this seems to have worked beautifully! Thanks again for your help!

[csgaraglino]

I did as you susgested, deleted all the history from the browsers, and as soon as I load the page, the cookies are still being created?

[12Robots]

Can you post the code from your Applciation.cfc or Application.cfm?

[12Robots]

When you say you "deleted history" do you mean you deleted all of your cookies?