Internet Explorer pioneered a great security feature for cookies called HTTPOnly, when this flag is set the browser does not allow JavaScript to access the cookie. Now that all modern browsers support this flag it can reduce the risk of session hijacking due to cross site scripting. For that reason many security auditors will take marks off if you are not using it for your session identifier cookies (eg cfid, cftoken, and jsessionid).

I recently updated my ColdFusion Security Scanner, hackmycf.com to check for the omission of HTTPOnly session cookies. It now provides a warning if the cfid, cftoken, or jsessionid cookies do not set the HTTPOnly flag. We now also offer a subscription service which will scan your server automatically on a daily, weekly, monthly or quarterly basis.

ColdFusion 9 also introduced an attribute on the cfcookie tag called httponly which you can set to a boolean value. Prior to CF9 you can still create HTTPOnly cookies with ColdFusion but you have to use cfheader instead of cfcookie to write the cookies.

If running ColdFusion 9.0.1

ColdFusion 9.0.1 update added support by a java system property called coldfusion.sessioncookie.httponly you can turn this on by editing the jvm.config and adding -Dcoldfusion.sessioncookie.httponly=true or if you are running Standalone you can add this in the ColdFusion Administrator.

If Running CF 9.0 or greater

If you have not upgraded to 9.0.1 yet, or would rather solve this issue in your code, here’s an example Application.cfc file you could use:

<cfcomponent>
  <cfset this.sessionmanagement = true>
  <cfset this.setclientcookies = false>
  <cffunction name="onSessionStart">
      <cfcookie name="CFID" value="#session.cfid#" httponly="true">
      <cfcookie name="CFTOKEN" value="#session.cftoken#" httponly="true">
  </cffunction>
<cfcomponent>

If Running CF 8 or Lower and using Application.cfc

<cfcomponent>
  <cfset this.sessionmanagement = true>
  <cfset this.setclientcookies = false>
  <cffunction name="onSessionStart">
      <cfheader name="Set-Cookie" value="CFID=#session.CFID#;path=/;HTTPOnly">
      <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly">
  </cffunction>
<cfcomponent>

Make sure you have setclientcookies = false specified.

If Using Application.cfm

If you are still using an Application.cfm file, you can use the following:

<cfapplication setclientcookies="false" sessionmanagement="true" name="test">
<cfif NOT IsDefined("cookie.cfid") OR NOT IsDefined("cookie.cftoken") OR cookie.cftoken IS NOT session.CFToken>
   <cfheader name="Set-Cookie" value="CFID=#session.CFID#;path=/;HTTPOnly">
   <cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly">
</cfif>

If using J2EE Session Cookies (jsessionid)

If you are using CF9.0.1 or greater use the java system property described above.

If you are using CF9.0 or lower, then you can edit the jrun-web.xml file located in WEB-INF as described here to enabled HTTPOnly cookies.

Jason Dean has also come up with a way to do this in onSessionStart as well.

Consider Setting The Secure Flag

If you have SSL, also consider setting the secure flag on your cookies. When the browser is given a cookie with the secure flag it only sends the cookie over a HTTPS connection.