ColdFusion Session Tracking http vs https

1
votes

Anytime a user tries to access our site with http, they are redirected to https via this code in the Application.cfc:

    If (CGI.HTTPS != "on") {
        location(url="https://#Application.PortalApp.GetDomain()##CGI.SCRIPT_NAME#?#CGI.QUERY_STRING#", addtoken="false");
    }

The strange thing is, if they have never accessed the site via http, but happen to click an internal link that points to http instead of https, they are logged out. However, once they login again, they can then access an http link, get redirected to https and stay logged into the system.

I did some line-by-line debugging and the https session gets overwritten when a user access http. But once a user accesses http, the https shares the sessionid.

Is this correct behavior?

In ColdFusion Administrator Session settings, HTTPOnly is set to true, and secure cookie is set to false.

4
sessioncoldfusion

4 Answers

3
votes

Think of them as two completely separate domains.

The session under HTTPS is a completely different session from the one under HTTP. That's just how that works.

Instead of controlling it at the application code level, you should configure your web server to only allow connections over HTTPS and automatically redirect HTTP requests to HTTPS.

More info can be found in this Google Developer page, but I'll paste the highlights.

HTTPS protects the integrity of your website

HTTPS helps prevent intruders from tampering with the communications between your websites and your users’ browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages.

HTTPS protects the privacy and security of your users

HTTPS prevents intruders from being able to passively listen in on the communications between your websites and your users.

You'll want to make sure that internal links on your site are never explicitly using HTTPS, so look into setting <base href="https://{yourDomain}" > in your layout files to force all relative URLs to use HTTPS.

1
votes

I've been having the same problem and this fixed it.

On Server2008, in IIS Manager, open up the ASP properties, expand "session properties", and change "New ID On Secure Connection" to "false".

0
votes

A couple suggestions:

  • Easy one first: this may not be the right direction, but what happens if, instead of using CGI.HTTPS, you use CGI.SERVER_PORT_SECURE?

  • If CF is overwriting the session when you switch from https to http, why not just handle this on the front end with the web server rather than through CF? IIS and Apache all have easy rewrites or redirects that may save you some time over trying to deal with CF, particularly if your whole application is secure anyway.

0
votes

It seems that the check for user being logged in is before the http to https check and redirect. If possible you should check for https first (redirect if is http) then check for logged in.