Re: httponly and cookie-secure

2014-05-21 Thread Pete Freitag
On Mon, May 19, 2014 at 9:45 AM, brad f wrote: > > Not sure what I am missing here. We are running Coldfusion 9.0.2 in a > clustered environment. I added the -Dcoldfusion.sessioncookie.httponly=true > to the jvm.config file. I restart the coldfusion instances. Run an > application scan and it st

httponly and cookie-secure

2014-05-19 Thread brad f
Not sure what I am missing here. We are running Coldfusion 9.0.2 in a clustered environment. I added the -Dcoldfusion.sessioncookie.httponly=true to the jvm.config file. I restart the coldfusion instances. Run an application scan and it still says the y are not httponly (also check using Chrome