How does ColdFusion map session?

Question

We are using ColdFusion 9.0.1 and are beginning to notice that with IE we will get two sets of session cookies (CFID, CFTOKEN, JSESSIONID) if we hit a subdomain followed by a root domain (e.g. www.example.com example.com)

ColdFusion seems to be able to successfully manage this fact and properly match the session with the proper session variables.

I'm looking to understand how ColdFusion/JRUN handle session variable mapping. I know that it the application name is part of the equation but what happens when there is more than one JSESSIONID cookie. How does it decide which one is right?

Answer 1

Cookies are domain specific by default, so that cookies created on www.foo.com won't carry over to foo.com. In your Application.cfc you need to set the setdomaincookies value to true, like so:

<cfapplication name="myapp" setdomaincookies="true" />

Or if you're writing it in cfscript:

this.setdomaincookies = true;

That will set your session cookies to be part of *.foo.com, and they'll carry from one subdomain to another without issue.