V-279106

Discussion

Cookies are often used to maintain user sessions in web applications. However, if cookies are not properly managed, they can pose a security risk. Persistent cookies that do not expire when the browser is closed can be exploited by attackers to gain unauthorized access to user sessions. By setting the cookie timeout to -1, ColdFusion ensures that cookies are only valid for the duration of the browser session. This means that when the user closes their browser, the session cookies are automatically deleted, reducing the risk of session hijacking and unauthorized access. In ColdFusion, administrators can configure the cookie timeout to -1 to enforce browser-session-based cookies. This setting enhances the security of the application by ensuring that user sessions are terminated when the browser is closed, thereby preventing potential security breaches. Satisfies: SRG-APP-000516-AS-000237, SRG-APP-000141-AS-000095, SRG-APP-000439-AS-000155, SRG-APP-000441-AS-000258

Check Content

Verify Session Cookie Settings.

From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables >> Session Cookie Settings.

If the Cookie Timeout is not set to "-1", this is a finding.

If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions" is not checked, this is a finding.

If the "Cookie Samesite default value" is not set to "Lax" or "Strict" for a default value, this is a finding.