ColdFusion must be configured to set the Secure attribute on session cookies to ensure that cookies are only transmitted over secure HTTPS connections.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-279109	SRG-APP-000516-AS-000237	APAS-CF-001075	SV-279109r1171101_rule	2025-12-19	1

Description
Session cookies are often transmitted over the network, and if they are not protected, they can be intercepted by attackers. By enabling the Secure attribute on session cookies, ColdFusion ensures that these cookies are only transmitted over secure HTTPS connections. This configuration helps protect the confidentiality and integrity of session cookies during transmission, reducing the risk of session hijacking and unauthorized access. Enabling the Secure attribute is a critical security measure to ensure that session cookies are not exposed to potential attackers.

Description

Session cookies are often transmitted over the network, and if they are not protected, they can be intercepted by attackers. By enabling the Secure attribute on session cookies, ColdFusion ensures that these cookies are only transmitted over secure HTTPS connections. This configuration helps protect the confidentiality and integrity of session cookies during transmission, reducing the risk of session hijacking and unauthorized access. Enabling the Secure attribute is a critical security measure to ensure that session cookies are not exposed to potential attackers.

ℹ️ Check
Verify Session Cookie " Secure Cookie" setting. 1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables. 2. Locate the options labeled "Session Cookie Settings". If "Secure Cookie" setting is not enabled (checked) for session cookies, this is a finding.

✔️ Fix
Configure Session Cookie setting. 1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables. 2. Locate the options labeled "Session Cookie Settings". 3. Enable (check) the Secure Cookie option. 4. Select "Submit Changes".