title: ColdFusion: CFID and CFToken change on each page request
body: <p>I have been asked to use J2EE Variables and not store the <code>CFID</code> and <code>CFTOKEN</code> in cookies, as the CFID is reported as non-compliant: <a href="https://helpx.adobe.com/coldfusion/kb/predictable-cookie-session-ids-reported.html" rel="nofollow noreferrer">Predictable Cookie Session ID's Reported by Compliance Tests</a></p>
  <ul>
  <li>In my Application.cfm, I have added <strong>setclientcookies=&quot;false&quot;</strong>.  This stops the CFID and CFToken being written as cookies.</li>
  <li>In the ColdFusion Admin, I have enabled J2EE Session Variables</li>
  </ul>
  <p>So I now have a cookie with <code>JESSIONID</code>, and a session variable with <code>URLToken</code> containing CFID and CFTOKEN. However, every time I refresh the page, the CFID and CFTOKEN change. They do not persist as they did before. Which mean our admin login system fails.</p>
  <p>I have done my own googling, but have found nothing so far. One suggestion I found was to write code to persist the CFID and CFTOKEN. However, this doesn't feel like a good solution.</p>
  <p>Any suggestions?</p>
  <p><strong>Barebones Test</strong></p>
  <p>I installed CF 10 Developer Edition and enabled J2EE Session Variables</p>
  <p>Created an Application.cfm with</p>
  <pre><code>&lt;cfapplication name=&quot;test&quot; sessionmanagement=&quot;Yes&quot; setclientcookies=&quot;false&quot;&gt;
  </code></pre>
  <p>and an index.cfm with</p>
  <pre><code>&lt;h1&gt;Cookie&lt;/h1&gt;
  &lt;cfdump var=&quot;#cookie#&quot;&gt;
  &lt;h1&gt;Session&lt;/h1&gt;
  &lt;cfdump var=&quot;#session#&quot;&gt;
  </code></pre>
  <p>The <code>Session.URLToken</code> changes with every refresh</p>
  <blockquote>
  <p>CFID=2212&amp;CFTOKEN=41db974c3d2eb4b6-640C21AE-FD53-499C-71FBEBA35D6B09E8&amp;jsessionid=E28AA17629928FB6F9E17674AC85C7AA.cfusion</p>
  <p>CFID=2213&amp;CFTOKEN=bb791a304929d0f5-6425021B-A31B-B9C8-3628AE391B0F48FF&amp;jsessionid=E28AA17629928FB6F9E17674AC85C7AA.cfusion</p>
  </blockquote>
  <p><strong>Further Thoughts</strong></p>
  <p>The <code>CFID</code>and <code>CFTOKEN</code> are used in our login system to verify the user session matches, maybe I should change it to store and verify against the <code>JESSIONID</code>. Maybe it doesn't matter that the <code>CFID</code>and <code>CFTOKEN</code> change. The session scope is actually maintained, so this could be a completely non-issue.</p>
  <pre><code>&lt;cfparam name=&quot;session.timestamp&quot; default=&quot;#now()#&quot;&gt;
  </code></pre>