Adobe 38043740 Lockdown Guide - Page 66

Setting Maximum Timeout: Session Variables Default Timeout: Session Variables Cookie Timeout Default 2 Days 20 Minutes 1440 Minutes HTTPOnly Checked Secure Unchecked Recommendation Description Lower Two days is generally too long for sessions to persist. Lower session timeouts reduce the window of risk of session hijacking. Lower Twenty minutes is a good default value, but high security applications will require a lower timeout value. -1 By setting to -1 ColdFusion will set the session cookie as a browser session cookie, which is valid as long as the users browser window is open. As of this writing you cannot specify a value of -1 using ColdFusion administrator, however you can set this value by editing the sessionCookieTimeout value in the neo-runtime.xml file. Checked Session cookies should always be marked as HTTPOnly to prevent JavaScript or other client side technologies from accessing their values (on supported clients). Checked if all sites A client will only transmit a secure require SSL. cookie over a secured connection (eg SSL). 66