When a user has a JSESSIONID cookie, Lucee will use this (even if session type = application), causing sessions to be immediately invalidated. Also, you cannot expire a JSESSIONID cookie using cfcookie (no error, just leaves the cookie in the browser).

Backstory
We've recently migrated from ACF to Lucee and in ACF we had JEE sessions turned. However, since we're clustering and can't use JEE sessions in Lucee we've turned that off and use our db as the client store.

This works fine, unless a user had an active cookie in the ACF site prior to the cutover. In these scenarios the JSESSIONID cookie exists on the client, and it appears Lucee still tries to use it. When that happens our users cannot login because the session seems to immediately invalidate. If we manually delete the JSESSIONID cookie from the client, all is well. Since we have thousands of users that would have to call support to walk through the clear cookie process, we tried to use cfcookie to expire the JSESSIONID cookie. This would not expire/remove the cookie. We ended up having to drop in some JavaScript to delete the cookie, which worked, but is definitely a hack.

Workaround/Hackaround
Embed JavaScript that will delete the JSESSIONID cookie: