Session Cookies

We all know Coldfusion tracks your sessions by writing cookie.cfid cookie.token but did you know that the cookie by default expires in the year 2037.

This may seem of little consequence but it does raise some security issues depending on the sensitivity of the application you are working on.

It means that each time you visit the site again Coldfusion reuses the same cfid and cftoken. This has the potential to provide a means for session hijacking, which of course is not a good thing!

Thankfully there is a relatively easy way to turn your persistent cookies into session cookies.

This effectively means that when you close the browser your session expires and therefore the cookie also expires.

Potential session hijacking issue solved.

Happy Coding...

PS: I realize a lot of people are probably already doing this but I felt it deserved a mention.