J2EE Session Cookies on ColdFusion / JRun

February 08, 2010
coldfusionjava

As you are probably aware ColdFusion allows you to use the integrated J2EE sessions that are provided as part of the J2EE server (by enabling the Use J2EE session variables setting in ColdFusion Administrator). When you enable this setting, a cookie called JSESSIONID is used to store the session identifier.

One of the drawbacks to session cookies in ColdFusion is that there is little control over the cookies that are created, you typically need to set the cookies in your onSessionStart event method with cfcookie to add security settings like HttpOnly or secure.

J2EE typically provide a way to specify settings J2EE session cookie ( typically called JSESSIONID, you can usually change the name of this cookie if you want). In JRun 4, the settings can be added to the jrun-web.xml file located in the WEB-INF folder. Here's an example of of how you might add the secure flag to the JSESSIONID cookie:

<jrun-web-app>
 <session-config>
    <cookie-config>
        <active>true</active>
        <cookie-secure>true</cookie-secure>
    </cookie-config>
 </session-config>
</jrun-web-app>

It is important to understand that this change will affect all sites on your ColdFusion server, so it may not be the best approach for all server setups.

You can find the documentation for the JRun session-config tag and its children here: here.

So what about HttpOnly cookies? You have probably noticed that there is no setting for this in JRun, I did find a way to get it working by appending it to the path, for example:

<cookie-path>/;HttpOnly</cookie-path>

That's not documented anywhere, but it does work. The cookie-path tag goes inside the cookie-config tag.

If you are using any JEE server besides JRun (eg Tomcat has one, WebLogic, etc), there is probably a documented method for creating HttpOnly J2EE session cookies.

Update: ColdFusion 9.0.1 added support for a httponly java system property that you can use instead. See details on HttpOnly cookies in ColdFusion.



Related Entries

3 people found this page useful, what do you think?

Comments

Does this work in CF8, 9, or both? I tried adding your httpOnly cookie-path tag to a CF8 config file, but could not get the CF service to restart.
Pete,

Just a small typo correction in the xml (missing a / in the end cookie-config tag).

<jrun-web-app>
<session-config>
<cookie-config>
<active>true</active>
<cookie-secure>true</cookie-secure>
</cookie-config>
</session-config>
</jrun-web-app>
Found this blog post while researching how to set httpOnly by default with ColdFusion. It appears that using <cookie-path>/;HttpOnly</cookie-path> will solve the issue. Does it belong inside the <cookie-config> tags like so?
<jrun-web-app>
<session-config>
<cookie-config>
<cookie-path>/;HttpOnly</cookie-path>
<cookie-config>
</session-config>
</jrun-web-app>
@Paul - perhaps you put the cookie-path tag in the wrong location, or forgot to close a tag. If the XML file is not valid xml and does not conform to the jrun DTD then it will cause the server not to start.

@Joe - Thanks, I updated the blog entry.

@John - Yes it does belong inside the cookie-config tags, I updated the blog entry to make that more clear.
At last! Someone who undreastnds! Thanks for posting!
Logs rule! My motto always is log it all, space is cheap and kwndleoge is power As for you setup when I use to run ACF and Railo on the same Apache instance I put both of the jrun/ACF and railo configurations out into a seperate conf file called jrun.load and railo.load. From my virtualhosts I then simply add either of the following line depending on what that sige required.Include /etc/apache2/jrun.load orInclude /etc/apache2/railo.loadShould probably blog this

Post a Comment




  



Spell Checker by Foundeo

Recent Entries



foundeo


did you hack my cf?