Highlighted

Is it possible to reset jsessionid?

Explorer ,
Jun 06, 2018

Copy link to clipboard

Copied

Hi,

We have new requirement from security department to reset jsessionid after a user resets his password.

I tried to reset it with this statement <cfcookie name="jsessionid" value="#VARIABLES.RandomID##cookie.jsessionid#" domain="#REQUEST.Site.Domain#" httponly="true" secure="yes">

But, this created a second jsessionid.

CF2016

Thank you,

Gena

Views

843

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more

Is it possible to reset jsessionid?

Explorer ,
Jun 06, 2018

Copy link to clipboard

Copied

Hi,

We have new requirement from security department to reset jsessionid after a user resets his password.

I tried to reset it with this statement <cfcookie name="jsessionid" value="#VARIABLES.RandomID##cookie.jsessionid#" domain="#REQUEST.Site.Domain#" httponly="true" secure="yes">

But, this created a second jsessionid.

CF2016

Thank you,

Gena

Views

844

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Jun 06, 2018 0
Adobe Community Professional ,
Jun 06, 2018

Copy link to clipboard

Copied

This cookie is set by Tomcat, not by CF really. It's a session cookie, and you can't just create a new one from CF. It uses a system-generated UUID, and you can't just put whatever value you want in there. You should be able to expire the current one with CFCOOKIE, though, and Tomcat will automatically set a new one on the following response to the request without a session cookie.

Dave Watts, Fig Leaf Software

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jun 06, 2018 0
Explorer ,
Jun 06, 2018

Copy link to clipboard

Copied

Hi Dave,

I did this

<cfcookie secure="yes" name="JSESSIONID" value="" domain="#REQUEST.Site.Domain#" expires="now" httponly="true">

Then, refreshed and the cookie did not change.

Thanks

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jun 06, 2018 0
Adobe Community Professional ,
Jun 06, 2018

Copy link to clipboard

Copied

I would try removing the VALUE attribute, and maybe all the other attributes except the EXPIRES attribute. If none of those combinations work, you might have to see how Tomcat controls this and look at changing the Tomcat configuration in its own configuration files (context.xml etc in /cfusion/runtime/conf).

Dave Watts, Fig Leaf Software

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jun 06, 2018 0
Adobe Community Professional ,
Jun 06, 2018

Copy link to clipboard

Copied

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jun 06, 2018 0
BKBK LATEST
Adobe Community Professional ,
Jun 16, 2018

Copy link to clipboard

Copied

genadi_mak  wrote

We have new requirement from security department to reset jsessionid after a user resets his password.

Why get involved with the session apparatus every time users reset their password? Imagine having to tinker with the engine every time a driver gets in or out of a car! A neater solution is to decouple driver permission from the workings of the engine.

This analogy suggests one way to solve your problem.

1) Enable the use of JsessionId in the ColdFusion Administrator;

2) Use the cflogin framework - including cflogout - to log users in and out;

3) In Application.cfc, set the value of the loginStorage attribute to "session".

That's it. It is tight in security terms, and quite convenient, too. You don't have to worry about the sessionId.

When the user is logged in, then

  • session.cfauthorization_yourApplicationName exists
  • getAuthUser() returns the username (with which ColdFusion logged the user in, for example, by means of cfloginuser)
  • isUserLoggedIn() returns Yes

When the user is logged out, then

  • session.cfauthorization_yourApplicationName does not exist
  • getAuthUser() returns an empty string
  • isUserLoggedIn() returns No

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jun 16, 2018 0