make JSESSIONID in COldFusion not able to be cached

Posted on 2009-05-01
Last Modified: 2013-12-24
This is second big problem I am having with ColdFusion built-in variable JSESSIONID. I am using it as a cookie to keep track of sessions.

When I run a security report, report tells me that JESSIONID is a security danger because it can be cached.

So I try to make it not be cached by adding this to make no cookies be cached:

<cfheader name="Cache-control" value="no-cache='set-cookie'">

But still says it is cached. How do I make it not be cached?

Thank you!

PS I also have similar problem cannot make JSESSIONID a HTTPOnly cookie:
Question by:adnank
    1 Comment
    LVL 1

    Accepted Solution

    By stating that JSESSIONID is giving you some trouble, I'm assuming you've setup CF to use J2EE sessions... which is a good thing.

    These cookies should definitely be erased when the browser is closed. Are you experiencing something to the contrary? In other words, after closing a browser and then reopening it, is your JSESSIONID cookie still there?

    What security report are you running?

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Suggested Solutions

    This is an updated version of a post made on my blog over 3 years ago. It is unfortunately, still very relevant as we continue to see both SQLi (SQL injection) and XSS (cross site scripting) attacks hitting some of the most recognizable website and …
    Periodically we have to update or add SSL certificates for customers. Depending upon your hosting plan you may be responsible for the installation and/or key generation. In the wake of Heartbleed many sites were forced to re-key. We will concen…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now