J2EE Sessions in CF10 Uses Secure Cookies

This week I helped out a client resolve an issue due to a change in behavior from CF9 to CF10. CF10 automatically adds the secure flag to cookies when the request is over a secure HTTPS channel. CF9 and lower do not add the secure flag to your JSESSIONID cookies when the request is over HTTPS, you can set a flag to force it in all cases (by editing jrun-web.xml), but there is no way to do it conditionally.

It turns out this is a feature of Tomcat, not CF10

I did some digging in the Tomcat source code and found that this functionaility is hard coded into Tomcat, and there is no config to control it. If you are curious you can see the source code here: ApplicationSessionCookieConfig:141

// Always set secure if the request is secure
if (scc.isSecure() || secure) {
    cookie.setSecure(true);
}

This can lead to session loss, BUT it is also a good security feature

The secure flag on a cookie means that it will only send the cookie over a secure channel like HTTPS, so when a JSESSIONID cookie is set with a secure flag, it will not be sent on a HTTP request that is not HTTPS, so you have two sessions one for HTTPS and one for HTTP.

You can't securely share a session on both HTTP and HTTPS

While a lot of people want to share a session between http and https there is no way to do it in a secure way, once the JSESSIONID is sent over HTTP you have an opportunity for a man in the middle to snatch it.

A good way to solve this problem is to only use sessions on HTTPS, for any url that requires a session make sure it is over HTTPS. The best is to simply use HTTPS for everything.

For this particular customer it would take a major rewrite to accomodate all HTTPS or to switch away from J2EE sessions (note for CFID/CFTOKEN sessions you can controll the secure flag of the cookies in the Application.cfc using this.sessionconfig.secure=true/false). So they needed a workaround.

Here is a workaround (but know that it lessens the security of your sessions over https)

Keep in mind this workaround decreases security. So we need to remove the secure flag from the JSESSIONID cookie, and there is no easy way to do this in Tomcat or CFML that I'm aware of. So my solution was to rewrite the cookie in IIS using URL Rewrite, here's how you do this:

1. Install Microsoft URL Rewrite for IIS: http://www.iis.net/downloads/microsoft/url-rewrite
2. Close IIS, and open it again.
3. Click On the root server level node of IIS (so that this is applicable to all sites on your server),
4. Double Click on the URL Rewrite icon
5. Click on Add Rule(s)
6. Under Outbound Rules select Blank Rule
7. Give it an arbitrary name, eg RemoveSecureFlagOnJSESSIONID
8. Under Match, select Matching Scope: Server Variable
9. For Variable name use: RESPONSE_Set-Cookie
10. Variable Value: Matches Pattern
11. Using: Regular Expressions
12. Pattern: ^(.*JSESSIONID.*)Secure;(.*)$
13. Under Action, Action Type: Rewrite
14. Action Properties: Value: {R:1}{R:2}
15. Check replace existing server variable

Or here's how you can add it to a single site using web.config files:

<rewrite>
            <outboundRules>
                <rule name="RemoveSecureJessionID">
                    <match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*JSESSIONID.*)Secure;(.*)$" />
                    <action type="Rewrite" value="{R:1}{R:2}" />
                </rule>
            </outboundRules>
</rewrite>

Note you can also use this technique to improve the security of JSESSIONID cookies on CF9 and lower by adding a HttpOnly flag or a secure flag to the cookie.