Coldfusion 10 cross domain HTTPS session problems

Question

Just wondering if anyone has come across an issue in CF10 whereby sessions are dropped when crossing between subdomains for the same Application under HTTPS, even though the JSESSIONID is being explicitly passed in these links which had worked for us for over 5 years without fail prior to CF10. From what I have read there appears to be a big change to address the Session Fixation security issues in CF10 which explains why the sessions would drop jumping between HTTP and HTTPS but this doesn't explain my issue. I understand the Session Fixation changes introduced in CF 9.02 and CF will definitely have an impact on our passing JSESSIONID via the URL, however this behaviour has been removed still the session is dropping.

Essentially we have CF10 installed with J2EE Session Management turned on, and the default HTTPOnly set to true. This is a single CF Application with the same Application name, setClientCookies is false and in the application the domain structure looks as follows:

https://book.domain.com
https://profile.domain.com
https://approve.domain.com

When crossing between the domains (which had worked for many years prior) the session drops and CF issues a new set of session identifiers.

Even setting a cookie in the onSessionStart() as follows has no effect:

<cfcookie name="jsessionid" value="#session.sessionid#" domain=".domain.com" secure="true">

Has anyone come across this behaviour migrating to CF10?

Cheers Phil

Have you observed whether the cookie is getting passed when crossing between http and https ? — Dungeon Hunter
Hi Dungeon Hunter. When I observe the headers of the page the transition between HTTP and HTTPS on the same domain works fine. When i change between subdomains a new session cookie is issued by Coldfusion and that is the behaviour i'm trying to stop. — Phil Rasmussen
As the jsessionid cookie was set at domain level browser sends that cookie as part of sub domain requests. does session replication is enabled between the sub domain and the main domain ? — Dungeon Hunter
I am wondering if the issue is due to the main domain never being involved and purely subdomains. You login via a subdomain and you jump between sub domains, but the parent domain is a completely separate website. So the session cookie is not being persisted between say book.domain.com and profile.domain.com — Phil Rasmussen

Phil Rasmussen Phil Rasmussen · Accepted Answer · 2014-04-08T00:58:47

So after playing around with a number of settings and ideas I now have the sessions behaving across the subdomains mentioned in my original question over HTTPS and using secure (browser based) cookies, thereby satisfying PCI-DSS Compliance requirements. All passing of JSESSIONID via the URL was removed from the system and the following lines added into the Application.cfc for both the constructors and the onSessionStart(). Note the setDomainCookies and setClientCookies set to false and the Domain specific sessioncookie settings below and also note in the onSessionStart my cookie being set without an expiry to ensure it only lasts for the duration of the browser, and the new CF10 encodeValue attribute to prevent strange encoding issues with the cookie values:

<cfcomponent hint="Application" output="false">

<cfscript>

   // Application Settings
   this.name = "myApplication";
   this.applicationTimeout = createTimeSpan(0,2,0,0);
   this.clientManagement = false;
   this.loginStorage = "session";
   this.sessionManagement = true;
   this.sessionTimeout = createTimeSpan(0,1,0,0);
   this.setClientCookies = false;
   this.setDomainCookies = false;

   // Domain specific settings for session persistence over subdomains
   this.sessioncookie.domain = '.domain.com';
   this.sessioncookie.httponly = true;

</cfscript>

<cffunction name="onSessionStart" returnType="void" output="false">
    <cfcookie name="jsessionid" value="#session.sessionid#" secure="true" domain=".domain.com" encodeValue="false">
</cffunction>

</cfcomponent>

Coldfusion 10 cross domain HTTPS session problems

1 Answers