Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
2 of 2

Client cookies are not marked as secure and httpOnly

Fixed

Description

Using `this.sessionCookie` allows to set the `secure` and `httpOnly` flags to `cfid` and `cftoken`, but if the Client store is set to Cookie, the Client cookies are not marked as httpOnly/secure. That breaks PCI Compliance.

Environment

None

is blocked by

Details

Assignee

Reporter

Priority

Labels

Fix versions

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Created 19 April 2019 at 19:37
Updated 1 August 2020 at 13:50
Resolved 19 April 2019 at 20:35

Activity

Show:

Flag notifications