Coldfusion 9 cfscript cfcookie and cookie (script style)

Question

I am trying to set my cookie CFIDE and CFTOKEN to be HTTPOnly in Coldfusion 9...

Here is what I have tried (didn't error but didn't work):

cookie.CFID = "#session.cfid#,httpOnly='true'";
cookie.CFTOKEN = "#session.cftoken#,httpOnly='true'";

I also tried (no go...and no error):

cookie.CFID = "#session.cfid#;httpOnly='true'";
cookie.CFTOKEN = "#session.cftoken#;httpOnly='true'";

And this (which I think only works in CF10):

cookie.CFID = {value="#session.cfid#", httpOnly="true"};
cookie.CFTOKEN = {value="#session.cftoken#", httpOnly="true"};

Then this (didn't error but didn't work):

cookie( name="CFID" value="#session.cfid#" httpOnly="true" );
cookie( name="CFTOKEN" value="#session.cftoken#" httpOnly="true" ); 

When I run these I do a empty cache hard reload in Chrome. When the page reloads I should see the Resources Cookies HTTPOnly column show check boxes.

I'm probably exhausted and could have hit the right combo of things above and I got a false positive on failure from jumping around too much. Sometimes cached things get the best of me.

I have the CFML container style that works but my Application.cfc is all script style and I want to keep it that way...So how do I do this script style in Coldfusion 9?

Update for my fix:

I used the getPageContex() below, but it didn't work as it was. Also onSessionStart() event handler changed to create the session.CFID and session.CFTOKEN with the CreateUUID() which is also new in my Application.cfc file. So for posterity here is what that block of code looks like.

function onSessionStart(){
getPageContext().getResponse().addHeader("Set-Cookie", "CFID=#session.CFID#;path=/;HTTPOnly");
getPageContext().getResponse().addHeader("Set-Cookie", "CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly");
}

Another Note: For some reason if the session is cleared and the onsessionstart() handler is requested this set cookie stuff above will fail. There has to be a try catch block or exception handling of some sort added to account for a reload problem. The best thing is to upgrade to a patched up release of Coldfusion 10 (or soon to be released CF 11).

Answer 1

You can use the PageContext object to set cookies in cfscript:

getPageContext().getResponse().addHeader("Set-Cookie", "CFID=#session.CFID#;path=/;HTTPOnly");
getPageContext().getResponse().addHeader("Set-Cookie", "CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly");

Answer 2

For session cookies, there's an easier way.

Enabling server-wide HttpOnly session cookies

The ColdFusion 9.0.1 update added a server-wide setting to add the httponly attribute to all session cookies created by ColdFusion (such as the CFID and CFTOKEN cookies, or the JSESSIONID cookie on JRun). To enable this setting, if you are running a JRun J2EE installation or multi-server installation, you must edit jvm.config, otherwise you can enable this setting from the CF Administrator. If you are running a J2EE server other than JRun consult your documentation for an appropriate setting. J2EE servers that support the Servlet 3.0 specification can specify true in the /WEB-INF/web.xml file.

http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html

Answer 3

You can use this code in your application.cfc inside of the onsessionstart function.

          <cfcookie name="CFID" value="#session.cfid#" httponly="true">
          <cfcookie name="CFTOKEN" value="#session.cftoken#" httponly="true">

There is no way of setting this inside of cfscripts. cfcookie is not supported in script form in cf9. There are flags in the application settings added to CF10 to address this issue, however, CF11 will have full support for it inside of scripts. Unfortunately, I think you will have to forego the uniform code for functionality. Unless you have access to your CFIDE/Administrator. You can add a java argument to turn it on server wide. Add this to your JVM config

-Dcoldfusion.sessioncookie.httponly=true

All of this is detailed here http://www.petefreitag.com/item/764.cfm