Adobe 38043740 - ColdFusion Standard - Mac Manual page 66

Setting Default
Maximum 2 Days
Timeout:
Session
Variables
Default 20 Minutes
Timeout:
Session
Variables
Cookie 1440 Minutes
Timeout
HTTPOnly
Checked
Secure Unchecked
Recommendation Description
Lower Two days is generally too long for
sessions to persist. Lower session
timeouts reduce the window of risk
of session hijacking.
Lower Twenty minutes is a good default
value, but high security applications
will require a lower timeout value.
-1 By setting to -1 ColdFusion will set
the session cookie as a browser
session cookie, which is valid as
long as the users browser window is
open.
As of this writing you cannot specify
a value of -1 using ColdFusion
administrator, however you can set
this value by editing the
sessionCookieTimeout
in the neo-runtime.xml
Checked Session cookies should always be
marked as HTTPOnly to prevent
JavaScript or other client side
technologies from accessing their
values (on supported clients).
Checked if all sites A client will only transmit a secure
require SSL. cookie over a secured connection
(eg SSL).
value
file.
66