Setting Secure cookies when HTTPS (for mixed HTTPS/HTTP site) with JRun/ColdFusion

Question

We have a site running on CF7 that has both logged in and logged out sections, and uses jsessionid for sessions.

When switching to HTTPS (for the secure sections), we need to start a new secure session, setting the 'Secure' flag on the jsessionid cookie.

Whilst JRun has an option for setting 'Secure' it appears to be an all-or-nothing deal.

Is there a way to always use Secure when in HTTPS mode?

Related Question: Setting HttpOnly flag for all cookies.

Palimpsest

Answer 1

This explanation seems quite thorough. For some reason, it is not trivial.

12robots.com Making the JSESSIONID Session Token Cookie SECURE and HTTPOnly and settings its PATH

Drennen

Oh, I just see you had that recommendation already, just in a different question. :) I don't think there is a smooth way to do what you want. IMHO, this should be handled transparently by the server. – Drennen

Heh yeah, I split the questions out since they're distinct issues, but I did intend to explicitly link them to each other, will go do that now. And I definitely agree this should be handled by the server - might be worth checking if Tomcat or Resin provides better control over this. – Palimpsest