How to Set up HTTPOnly and SECURE FLAG for session cookies

Hi All,

To fix some vulnerability issues (found in the ethical hacking , penetration testing) I need to set up the session cookies (CFID , CFTOKEN , JSESSIONID) with "HTTPOnly" (so not to access by other non HTTP APIs like Javascript). Also I need to set up a "secure flag" for those session cookies.

I have found the below solutions.

For setting up the HTTPOnly for the session cookies.

1] In application.cfc we can do this by using the below code. Or we can do this in CF admin side under Server Settings » Memory Variables

     this.sessioncookie.httponly = true;

For setting up the secure flag for the session cookies.

2] In application.cfc we can do this by using the below code. Or we can do this in CF admin side under Server Settings » Memory Variables

     this.sessioncookie.secure = "true"

Here my question is how we can do the same thing in Application.cfm?. (I am using ColdFusion version 10). I know we can do this using the below code , incase of HTTPOnly (for example).

<cfapplication setclientcookies="false" sessionmanagement="true" name="test">

<cfif NOT IsDefined("cookie.cfid") OR NOT IsDefined("cookie.cftoken") OR cookie.cftoken IS NOT session.CFToken>

  <cfheader name="Set-Cookie" value="CFID=#session.CFID#;path=/;HTTPOnly">

  <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly">

</cfif>

But in the above code "setclientcookies" has been set to "false". In my application (it is an existing application) this has already been set to "true". If I change this to "false" as mentioned in the above code then ColdFusion will not automatically send CFID and CFTOKEN cookies to client browser and we need to manually code CFID and CFTOKEN on the URL for every page that uses Session. Right???. And this will be headache.Right???. Or any other way to do this.

Your timely help is well appreciated.

Thanks in advance.