ColdFusion must be configured to set the Secure attribute on session cookies to ensure that cookies are only transmitted over secure HTTPS connections.

Session cookies are often transmitted over the network, and if they are not protected, they can be intercepted by attackers. By enabling the Secure attribute on session cookies, ColdFusion ensures that these cookies are only transmitted over secure HTTPS connections. This configuration helps protect the confidentiality and integrity of session cookies during transmission, reducing the risk of session hijacking and unauthorized access. Enabling the Secure attribute is a critical security measure to ensure that session cookies are not exposed to potential attackers.

Verify Session Cookie " Secure Cookie" setting.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables.

2. Locate the options labeled "Session Cookie Settings".

If "Secure Cookie" setting is not enabled (checked) for session cookies, this is a finding.

Configure Session Cookie setting.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables.

2. Locate the options labeled "Session Cookie Settings".

3. Enable (check) the Secure Cookie option.

4. Select "Submit Changes".