tags:

views:

664

answers:

1
+1  Q: 

Setting Secure cookies when HTTPS (for mixed HTTPS/HTTP site) with JRun/ColdFusion

We have a site running on CF7 that has both logged in and logged out sections, and uses jsessionid for sessions.

When switching to HTTPS (for the secure sections), we need to start a new secure session, setting the 'Secure' flag on the jsessionid cookie.

Whilst JRun has an option for setting 'Secure' it appears to be an all-or-nothing deal.

Is there a way to always use Secure when in HTTPS mode?


Related Question: Setting HttpOnly flag for all cookies.

+1  A: 

This explanation seems quite thorough. For some reason, it is not trivial.

12robots.com Making the JSESSIONID Session Token Cookie SECURE and HTTPOnly and settings its PATH

Tomalak  2009-06-26 12:04:35
Oh, I just see you had that recommendation already, just in a different question. :) I don't think there is a smooth way to do what you want. IMHO, this should be handled transparently by the server.
Tomalak  2009-06-26 12:15:31
Heh yeah, I split the questions out since they're distinct issues, but I did intend to explicitly link them to each other, will go do that now. And I definitely agree this should be handled by the server - might be worth checking if Tomcat or Resin provides better control over this.
Peter Boughton  2009-06-26 12:47:21

related questions

Encryption in C# Web-Services
How Do You Secure database.yml?
ASP.NET LocationProvider
What do you (or your company) use for wiping a machine?
Can a proxy server cache SSL GETs? If not, would response body encryption suffice?
Java: What is the best way to SFTP a file from a server
How do I call a Flex SWF from a remote domain using Flash (AS3) ?
Best way to store a database password in a startup script / config file?
Using VM to get around VPN restrictions
Best references for secure coding practices in ASP.NET and classic ASP.
Secure Memory Allocator in C++
Resolving Session Fixation in JBoss
Best Practices for securing a REST API / web service
Defensive programming
Personal Linux web server
Block user access to internals of a site using HTTP_REFERER
Is there an Unobtrusive Captcha for web forms?
My website got hacked... What should I do?
What all do I need to escape when sending a (My)SQL query?
How do you disable browser Autocomplete on web form field / input tag?
Best .NET obfuscation tools/strategy
Are there best practices for testing security in an Agile development shop?
What is the best way to avoid SQL injection attacks?
Found a critical bug, but the company doesn't care
PHP Session Security