Pete FreitagJuly 14, 2011
Client Variable Cookie CFGLOBALS Includes Session Ids
I was recently conducting a CFML security review for a client and realized that when you have client variables set to use Cookies, the session ID's (eg CFIDE and CFTOKEN) are included in the CFGLOBALS cookie.
