Issues

remove support for loginStorage="cookie" and sessionStorage="cookie"

allow auto session rotate on unknown session cookie (disabled)

buffer set-cookie headers, to avoid duplicate set-cookie headers

Can't delete Cookie in 6.2.0.284

Performance Issue with <cfcookie> Tag Using expires="3"

reflect user-agent in cfid

add support for Partitioned cookies

cookies expires timestamps are in UTC not GMT

All the Set-Cookie calls (with an expires) are synchronized

internalRequest not parsing set-cookie headers

Regression: Custom cookie parsing now used over servlet's cookies

5.3.9 regression, cookie encoding/decoding problems

Application Session Cookie Timeout doesn't support -1 (browser session)

CFGlobal variables are created in an unsecure cookie

cfcookie() ignores the encodevalue=“yes” parameter

Allow default session cookie name to be customized

admin cookies should be scoped to the admin folder path

Change session cookie defaults to be secure in Lucee 6 (samesite=lax, httponly=true)

cfid management

JSESSIONID cookie causes issue when session type = Application

/lucee/graph.cfm doesn't need and shouldn't set session cookies

Disable setting of session cookies CFID and CFToken doesn't work

add sessioncookie support for path attribute

cfhttp result cookie query resultset doesn't contain a samesite column

HttpOnly cookies are sent as HTTPOnly, it's case insensitive but better to be correct

SameSite for CFCookie doesn't send None values

Calling CFTHREAD Creates New JSESSIONID Cookie Even When Session Management Is Disabled

adding to cookie scope doesn't inherit application cfcookie tag defaults

CFID/cfid and CFTOKEN/cftoken cookies are not handled consistently if the application manages the cookies explicitly

Session storage in a cookie silently fails and saves nothing if it can't serialize session

When using Application.setClientCookies=true and CFCOOKIE to set expiration for CFTOKEN/CFID, cookies are set twice

cookie JSessionID with cfthread

Client cookies are not marked as secure and httpOnly

allow resetting http headers per request by buffering them

sessionRotate within onSessionStart duplicates CFID cookie header

Cookies aren't cased when sent to browser

Cfcookie reads empty cookies as Null

cookie scope doesn't error properly when writing complex objects

Add missing sessioncookie & authcookie attributes to cfapplication

Lucee fails to read cookie

make all system cookie names configurable and ditch unneeded ones