STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Adobe ColdFusion Security Technical Implementation Guide

V-279109

CAT II (Medium)

ColdFusion must be configured to set the Secure attribute on session cookies to ensure that cookies are only transmitted over secure HTTPS connections.

Rule ID

SV-279109r1171101_rule

STIG

Adobe ColdFusion Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Session cookies are often transmitted over the network, and if they are not protected, they can be intercepted by attackers. By enabling the Secure attribute on session cookies, ColdFusion ensures that these cookies are only transmitted over secure HTTPS connections. This configuration helps protect the confidentiality and integrity of session cookies during transmission, reducing the risk of session hijacking and unauthorized access. Enabling the Secure attribute is a critical security measure to ensure that session cookies are not exposed to potential attackers.

Check Content

Verify Session Cookie " Secure Cookie" setting.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables.

2. Locate the options labeled "Session Cookie Settings".

If "Secure Cookie" setting is not enabled (checked) for session cookies, this is a finding.

Fix Text

Configure Session Cookie setting.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables.

2. Locate the options labeled "Session Cookie Settings".

3. Enable (check) the Secure Cookie option.

4. Select "Submit Changes".