Forcing HttpOnly cookies with JRun/ColdFusion

views:

696

answers:

+3 Q:

Forcing HttpOnly cookies with JRun/ColdFusion

We need to ensure that all cookies on a CF7 site are set as HttpOnly.

We are using jsessionid to control our sessions, and JRun does not create this as HttpOnly.

Whilst it is possible to modify an existing cookie to add this setting, we need to have it set to HttpOnly from the start.

Any suggestions?

Related Question: Setting Secure flag for HTTPS cookies.

+1 A:

Good post all about it here: http://www.12robots.com/index.cfm/2009/5/6/Making-the-JSESSIONID-Session-Token-Cookie-SECURE-and-HTTPOnly-and-settings-its-PATH

DanSingerman 2009-06-26 11:05:51

I had an answer ready with the same reference, but that solution relies on modifying an existing cookie. Peter was asking whether you could create a jsessionid HttpOnly cookie from scratch

Vincent Buck 2009-06-26 11:13:37

We've tried something Jason Dean suggested before, but I think this is a new post. The key difference is that it is expiring the existing cookie and creating a new one all on the first request?

Peter Boughton 2009-06-26 11:18:44

(What we currently have involves a cflocation in onSessionStart, which works in some cases, but causes assorted other nightmares.)

Peter Boughton 2009-06-26 11:19:15

Vincent, the problem with a normal modification of the existing cookie is that the first request isn't secure (and our security scanning software picks this up and fails us) - the goal is for the first request to be secure (and pass the scanning), so if this post covers that then it will solve the problem.

Peter Boughton 2009-06-26 11:22:41

The goal is for the first request to be secure (and pass the scanning), so if this post covers that then it will solve the problem.

Correct me if I'm wrong, but it sounds like you need to redirect to HTTPS if a request comes in over HTTP. Can you not catch this with a URL rewriting rule, before the request is sent to ColdFusion at all?

Adam Tuttle 2009-06-29 16:51:32

We're unfortunately going via IIS 5, so can't do URL rewriting without expensive, buggy, third-party plugins. Unless there is some rewriting that can be done at the JRun level?

Peter Boughton 2009-06-30 12:47:06

I'm not aware of any JRun-level url rewriters. Running on IIS 5 seems like an odd requirement... but I can certainly understand that sometimes you have to work with what you've got. Good luck! :)

Adam Tuttle 2009-06-30 13:20:50

ansaurus

tags:

views:

answers:

Forcing HttpOnly cookies with JRun/ColdFusion

related questions