subject:"TEST"

It's a video streaming site for members. I can't believe my only option is
to stream video across ssl. There must be another solution.

-RR

On Tue, Mar 6, 2012 at 7:46 AM, DURETTE, STEVEN J sd1...@att.com wrote:

Just out of curiosity, why can't you have the entire session running under
SSL? Ever since Firesheep came out it is actually suggested to be all
encrypted all the time.

Steve

-Original Message-
From: Robert Rhodes [mailto:rrhode...@gmail.com]
Sent: Tuesday, March 06, 2012 2:20 AM
To: cf-talk
Subject: Failed PCI Compliance test on CF9.01

So a site that I built failed PCI compliance testing because the jsessionid
cookie is not set securely.

I found this post
http://thinkinglemur.com/index.php/2009/02/setting-secure-attribute-of-jsessionid-cookie-in-coldfusion-8/
that
shows how to force jrun to do always set the session cookies securely,
but the user loses their session state when they move between secure and
non-secure pages (the jsessionid is different for secure pages). This is
obviously a big problem, since we can't have the entire user session
running under ssl. Any ideas on how to get the jsessionid to be the same
on secure and non-secure pages? I am a little lost here.

I am running cf9.01, with the app set to sessionmanagement=yes and
setclientcookies=no. In the administrator, I have Cookie set as my
default client storage storage mechanism, and J2EE session variables
enabled. I also have use UUID for cftoken enabled, but since I have
setclientcookies set to no, I don't think that matters.

*-RR*

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive:
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350249
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


 It's a video streaming site for members.  I can't believe my only
 option is to stream video across ssl.  There must be another
 solution.

There is: take the main site out of scope for compliance.  The only
parts of a system that have to be PCI compliant are the ones that
handle credit card information, usually an online store or
subscription system.  There is no technical reason I can think of that
would require your billing system and video streaming servers to share
infrastructure.  Separating the billing system out on to its own
infrastructure means the rest of the system goes out of scope and then
you can do whatever you want with your cookies on the main part of the
site.  Keep the billing system isolated and your headaches will be
greatly reduced.


-Justin Sco

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350252
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Justin, thanks for the reply, and I get your point, but I can't break out
the registration process into a standalone site quickly.  There must be a
fairly quick solution to this problem.  Surely, I can't be the first to
deal with this.

On Tue, Mar 6, 2012 at 8:44 AM, Justin Scott leviat...@darktech.org wrote:


  It's a video streaming site for members.  I can't believe my only
  option is to stream video across ssl.  There must be another
  solution.

 There is: take the main site out of scope for compliance.  The only
 parts of a system that have to be PCI compliant are the ones that
 handle credit card information, usually an online store or
 subscription system.  There is no technical reason I can think of that
 would require your billing system and video streaming servers to share
 infrastructure.  Separating the billing system out on to its own
 infrastructure means the rest of the system goes out of scope and then
 you can do whatever you want with your cookies on the main part of the
 site.  Keep the billing system isolated and your headaches will be
 greatly reduced.


 -Justin Sco

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350253
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

RE: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Che Vilnonis


Robert, a product like Fuseguard from Pete Freitag or a Web Application
Firewall (or a plugin type of filter to your existing firewall) may help.
I'm currently going through a similar process and thought these options
might help.

Ché

-Original Message-
From: Robert Rhodes [mailto:rrhode...@gmail.com] 
Sent: Tuesday, March 06, 2012 9:08 AM
To: cf-talk
Subject: Re: Failed PCI Compliance test on CF9.01


Justin, thanks for the reply, and I get your point, but I can't break out
the registration process into a standalone site quickly.  There must be a
fairly quick solution to this problem.  Surely, I can't be the first to deal
with this.



~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350254
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Donnie Bachan (Gmail)


Robert,

This is odd that you are losing the session, are you using CF in
multiserver mode or standalone? The article you referenced was for CF8,
however, we're currently running CF9 Ent in multiserver mode and we've not
had this issue crop up. We are however using a DB with client cookies for
managing state across CF instances.

Best Regards,
Donnie Bachan
Nitendo Vinces - By Striving You Shall Conquer
==
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer.


On Tue, Mar 6, 2012 at 2:17 PM, Che Vilnonis ch...@asitv.com wrote:


 Robert, a product like Fuseguard from Pete Freitag or a Web Application
 Firewall (or a plugin type of filter to your existing firewall) may help.
 I'm currently going through a similar process and thought these options
 might help.

 Ché

 -Original Message-
 From: Robert Rhodes [mailto:rrhode...@gmail.com]
 Sent: Tuesday, March 06, 2012 9:08 AM
 To: cf-talk
 Subject: Re: Failed PCI Compliance test on CF9.01


 Justin, thanks for the reply, and I get your point, but I can't break out
 the registration process into a standalone site quickly.  There must be a
 fairly quick solution to this problem.  Surely, I can't be the first to
 deal
 with this.



 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350255
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Phillip Duba


I'll echo what Donnie said. We're actually running CF 8 with the DB client
settings and did not have any issues with the cookies in our PCI audit,

Phil

On Tue, Mar 6, 2012 at 9:24 AM, Donnie Bachan (Gmail) 
donnie.bac...@gmail.com wrote:


 Robert,

 This is odd that you are losing the session, are you using CF in
 multiserver mode or standalone? The article you referenced was for CF8,
 however, we're currently running CF9 Ent in multiserver mode and we've not
 had this issue crop up. We are however using a DB with client cookies for
 managing state across CF instances.

 Best Regards,
 Donnie Bachan
 Nitendo Vinces - By Striving You Shall Conquer
 =



~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350256
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


On Tue, Mar 6, 2012 at 9:07 AM, Robert Rhodes rrhode...@gmail.com wrote:

 Justin, thanks for the reply, and I get your point, but I can't break out
 the registration process into a standalone site quickly.  There must be a
 fairly quick solution to this problem.  Surely, I can't be the first to
 deal with this.


I think that the quick solution is to put everything under SSL.

-Cameron

-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350257
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


 Justin, thanks for the reply, and I get your point, but I can't break out
 the registration process into a standalone site quickly.  There must be a
 fairly quick solution to this problem.  Surely, I can't be the first to
 deal with this.

Another option might be to ask your scanning vendor for an exception
to that scanning rule.  If you can demonstrate to them that no credit
card information is accessible through the user's account (e.g. the
card number isn't visible anywhere, etc., and it really doesn't matter
if the session is hijacked from the standpoint of credit card
security) and explain the situation, they are generally willing to
work with you on this kind of thing.  Remember, their scanning rules
are designed to cover the widest possible threat model.  If you have
specific needs that don't fit into that model but have compensating
controls in place, it shouldn't be a problem (e.g. this used to be an
issue with the incremental session IDs which the scanners check for,
but paired with the random session token as a compensating control
they would always make an exception for this rule when asked).


-Justin Sco

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350258
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Donnie Bachan (Gmail)


Justin, I don't think that would work though, depending on the level of
compliance and the SAQ being completed I don't think any vendor will allow
that exemption regardless of if credit card information is visible or not.
If an attacker is allowed any access to a user session and can harvest any
personally identifiable information it could affect security of any credit
card entered into the site.

Best Regards,


Donnie Bachan
Nitendo Vinces - By Striving You Shall Conquer
==
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer.


On Tue, Mar 6, 2012 at 2:41 PM, Justin Scott leviat...@darktech.org wrote:


  Justin, thanks for the reply, and I get your point, but I can't break out
  the registration process into a standalone site quickly.  There must be a
  fairly quick solution to this problem.  Surely, I can't be the first to
  deal with this.

 Another option might be to ask your scanning vendor for an exception
 to that scanning rule.  If you can demonstrate to them that no credit
 card information is accessible through the user's account (e.g. the
 card number isn't visible anywhere, etc., and it really doesn't matter
 if the session is hijacked from the standpoint of credit card
 security) and explain the situation, they are generally willing to
 work with you on this kind of thing.  Remember, their scanning rules
 are designed to cover the widest possible threat model.  If you have
 specific needs that don't fit into that model but have compensating
 controls in place, it shouldn't be a problem (e.g. this used to be an
 issue with the incremental session IDs which the scanners check for,
 but paired with the random session token as a compensating control
 they would always make an exception for this rule when asked).


 -Justin Sco

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350260
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


 Justin, I don't think that would work though, depending on the level of
 compliance and the SAQ being completed I don't think any vendor will
 allow that exemption regardless of if credit card information is visible or
 not. If an attacker is allowed any access to a user session and can
 harvest any personally identifiable information it could affect security
 of any credit card entered into the site.

Perhaps, though you'd be surprised what they will sign off on with
proper compensating controls in place.  It can't hurt to ask, in any
case.  Ultimately, my advice in this situation is to isolate the
billing system so that the rest of the system isn't in scope for
compliance.  Trying to find a quick fix when it comes to PCI
compliance is just asking for problems.


-Justin

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350262
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


For both Phillip and Donnie -- I just set the site up for database storage
for the client session in the cf admin (server settings - client
variables), and I see data going in those two tables, but I am still losing
the session state when moving from https to http.  I have this set in my
application.cfm:

clientmanagement=Yes
sessionmanagement=Yes
setclientcookies=No
clientstorage=MyDSN

What am I doing wrong?

I did remove the change I made to jrun to force session cookies to be set
securely, but I doubt that matters now, because set client cookies is set
to no.

I am running cf 9.01 standard.

-RR

On Tue, Mar 6, 2012 at 9:24 AM, Donnie Bachan (Gmail) 
donnie.bac...@gmail.com wrote:


 Robert,

 This is odd that you are losing the session, are you using CF in
 multiserver mode or standalone? The article you referenced was for CF8,
 however, we're currently running CF9 Ent in multiserver mode and we've not
 had this issue crop up. We are however using a DB with client cookies for
 managing state across CF instances.

 Best Regards,
 Donnie Bachan
 Nitendo Vinces - By Striving You Shall Conquer
 ==
 The information transmitted is intended only for the person or entity to
 which it is addressed and may contain confidential and/or privileged
 material. Any review, retransmission, dissemination or other use of, or
 taking of any action in reliance upon, this information by persons or
 entities other than the intended recipient is prohibited. If you received
 this in error, please contact the sender and delete the material from any
 computer.


 On Tue, Mar 6, 2012 at 2:17 PM, Che Vilnonis ch...@asitv.com wrote:

 
  Robert, a product like Fuseguard from Pete Freitag or a Web Application
  Firewall (or a plugin type of filter to your existing firewall) may
 help.
  I'm currently going through a similar process and thought these options
  might help.
 
  Ché
 
  -Original Message-
  From: Robert Rhodes [mailto:rrhode...@gmail.com]
  Sent: Tuesday, March 06, 2012 9:08 AM
  To: cf-talk
  Subject: Re: Failed PCI Compliance test on CF9.01
 
 
  Justin, thanks for the reply, and I get your point, but I can't break out
  the registration process into a standalone site quickly.  There must be a
  fairly quick solution to this problem.  Surely, I can't be the first to
  deal
  with this.
 
 
 
 

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350265
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Phillip Duba


Are all your sites running under CF or do you have another Java-based app
server, like Tomcat/JBoss, running portions of your site as well? That
happened to me. Someone turned on sessions for a Tomcat app that didn't
need it and users would drop sessions as they moved around the site from
the CF side to the Tomcat side,

Phil

On Tue, Mar 6, 2012 at 10:33 AM, Robert Rhodes rrhode...@gmail.com wrote:


 For both Phillip and Donnie -- I just set the site up for database storage
 for the client session in the cf admin (server settings - client
 variables), and I see data going in those two tables, but I am still losing
 the session state when moving from https to http.  I have this set in my
 application.cfm:

 clientmanagement=Yes
 sessionmanagement=Yes
 setclientcookies=No
 clientstorage=MyDSN

 What am I doing wrong?

 I did remove the change I made to jrun to force session cookies to be set
 securely, but I doubt that matters now, because set client cookies is set
 to no.

 I am running cf 9.01 standard.

 -RR

 On Tue, Mar 6, 2012 at 9:24 AM, Donnie Bachan (Gmail) 
 donnie.bac...@gmail.com wrote:

 
  Robert,
 
  This is odd that you are losing the session, are you using CF in
  multiserver mode or standalone? The article you referenced was for CF8,
  however, we're currently running CF9 Ent in multiserver mode and we've
 not
  had this issue crop up. We are however using a DB with client cookies for
  managing state across CF instances.
 
  Best Regards,
  Donnie Bachan
  Nitendo Vinces - By Striving You Shall Conquer
  ==
  The information transmitted is intended only for the person or entity to
  which it is addressed and may contain confidential and/or privileged
  material. Any review, retransmission, dissemination or other use of, or
  taking of any action in reliance upon, this information by persons or
  entities other than the intended recipient is prohibited. If you received
  this in error, please contact the sender and delete the material from any
  computer.
 
 
  On Tue, Mar 6, 2012 at 2:17 PM, Che Vilnonis ch...@asitv.com wrote:
 
  
   Robert, a product like Fuseguard from Pete Freitag or a Web Application
   Firewall (or a plugin type of filter to your existing firewall) may
  help.
   I'm currently going through a similar process and thought these options
   might help.
  
   Ché
  
   -Original Message-
   From: Robert Rhodes [mailto:rrhode...@gmail.com]
   Sent: Tuesday, March 06, 2012 9:08 AM
   To: cf-talk
   Subject: Re: Failed PCI Compliance test on CF9.01
  
  
   Justin, thanks for the reply, and I get your point, but I can't break
 out
   the registration process into a standalone site quickly.  There must
 be a
   fairly quick solution to this problem.  Surely, I can't be the first to
   deal
   with this.
  
  
  
  
 
 

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350266
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Nope.  Just CF on this sever, and just this one site running.

On Tue, Mar 6, 2012 at 10:37 AM, Phillip Duba phild...@gmail.com wrote:


 Are all your sites running under CF or do you have another Java-based app
 server, like Tomcat/JBoss, running portions of your site as well? That
 happened to me. Someone turned on sessions for a Tomcat app that didn't
 need it and users would drop sessions as they moved around the site from
 the CF side to the Tomcat side,

 Phil

 On Tue, Mar 6, 2012 at 10:33 AM, Robert Rhodes rrhode...@gmail.com
 wrote:

 
  For both Phillip and Donnie -- I just set the site up for database
 storage
  for the client session in the cf admin (server settings - client
  variables), and I see data going in those two tables, but I am still
 losing
  the session state when moving from https to http.  I have this set in my
  application.cfm:
 
  clientmanagement=Yes
  sessionmanagement=Yes
  setclientcookies=No
  clientstorage=MyDSN
 
  What am I doing wrong?
 
  I did remove the change I made to jrun to force session cookies to be set
  securely, but I doubt that matters now, because set client cookies is set
  to no.
 
  I am running cf 9.01 standard.
 
  -RR
 
  On Tue, Mar 6, 2012 at 9:24 AM, Donnie Bachan (Gmail) 
  donnie.bac...@gmail.com wrote:
 
  
   Robert,
  
   This is odd that you are losing the session, are you using CF in
   multiserver mode or standalone? The article you referenced was for CF8,
   however, we're currently running CF9 Ent in multiserver mode and we've
  not
   had this issue crop up. We are however using a DB with client cookies
 for
   managing state across CF instances.
  
   Best Regards,
   Donnie Bachan
   Nitendo Vinces - By Striving You Shall Conquer
   ==
   The information transmitted is intended only for the person or entity
 to
   which it is addressed and may contain confidential and/or privileged
   material. Any review, retransmission, dissemination or other use of, or
   taking of any action in reliance upon, this information by persons or
   entities other than the intended recipient is prohibited. If you
 received
   this in error, please contact the sender and delete the material from
 any
   computer.
  
  
   On Tue, Mar 6, 2012 at 2:17 PM, Che Vilnonis ch...@asitv.com wrote:
  
   
Robert, a product like Fuseguard from Pete Freitag or a Web
 Application
Firewall (or a plugin type of filter to your existing firewall) may
   help.
I'm currently going through a similar process and thought these
 options
might help.
   
Ché
   
-Original Message-
From: Robert Rhodes [mailto:rrhode...@gmail.com]
Sent: Tuesday, March 06, 2012 9:08 AM
To: cf-talk
Subject: Re: Failed PCI Compliance test on CF9.01
   
   
Justin, thanks for the reply, and I get your point, but I can't break
  out
the registration process into a standalone site quickly.  There must
  be a
fairly quick solution to this problem.  Surely, I can't be the first
 to
deal
with this.
   
   
   
   
  
  
 
 

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350267
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Donnie Bachan (Gmail)


Hi Robert,

I'm not sure if I'm missing something but shouldn't you have
setClientCookies to Yes? Otherwise you'd have to pass the JSESSIONID in the
url on each request.

Best Regards,
Donnie Bachan
Nitendo Vinces - By Striving You Shall Conquer
==
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer.


On Tue, Mar 6, 2012 at 3:33 PM, Robert Rhodes rrhode...@gmail.com wrote:


 For both Phillip and Donnie -- I just set the site up for database storage
 for the client session in the cf admin (server settings - client
 variables), and I see data going in those two tables, but I am still losing
 the session state when moving from https to http.  I have this set in my
 application.cfm:

 clientmanagement=Yes
 sessionmanagement=Yes
 setclientcookies=No
 clientstorage=MyDSN

 What am I doing wrong?




~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350268
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


I just put back the jrun setting to pass cookies securely, and am sending
the jsessionid securely again.  And I am set up to use the database for
client storage.

It's still losing the session when I switch between http and https.

I do have setclientcookies to no, because that sets cfid and cftoken
insecurely which is what caused the PCI test failure.

This really should not be this hard.  I an't be the only person dealing
with this issue.  :(


On Tue, Mar 6, 2012 at 10:44 AM, Donnie Bachan (Gmail) 
donnie.bac...@gmail.com wrote:


 Hi Robert,

 I'm not sure if I'm missing something but shouldn't you have
 setClientCookies to Yes? Otherwise you'd have to pass the JSESSIONID in the
 url on each request.

 Best Regards,
 Donnie Bachan
 Nitendo Vinces - By Striving You Shall Conquer
 ==
 The information transmitted is intended only for the person or entity to
 which it is addressed and may contain confidential and/or privileged
 material. Any review, retransmission, dissemination or other use of, or
 taking of any action in reliance upon, this information by persons or
 entities other than the intended recipient is prohibited. If you received
 this in error, please contact the sender and delete the material from any
 computer.


 On Tue, Mar 6, 2012 at 3:33 PM, Robert Rhodes rrhode...@gmail.com wrote:

 
  For both Phillip and Donnie -- I just set the site up for database
 storage
  for the client session in the cf admin (server settings - client
  variables), and I see data going in those two tables, but I am still
 losing
  the session state when moving from https to http.  I have this set in my
  application.cfm:
 
  clientmanagement=Yes
  sessionmanagement=Yes
  setclientcookies=No
  clientstorage=MyDSN
 
  What am I doing wrong?
 
 


 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350269
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


On Tue, Mar 6, 2012 at 11:13 AM, Robert Rhodes rrhode...@gmail.com wrote:

 I just put back the jrun setting to pass cookies securely, and am sending
 the jsessionid securely again.  And I am set up to use the database for
 client storage.

 It's still losing the session when I switch between http and https.


sending securely means sending over HTTPS.  That is why non-SSL is losing
session.

-Cameron

-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350271
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

RE: Failed PCI Compliance test on CF9.01

2012-03-06 Thread DURETTE, STEVEN J


Your issue is more likely the fact that you are switching between https and 
http. I don't believe that the cookies can cross that barrier.

However as to your cookies not being secure check out the article by Pete 
Freitag : Adobe developer connection / ColdFusion Developer center / Securing 
your applications using HttpOnly cookies with ColdFusion.  (sorry I don't have 
the url) It has a section on using secure cookies with https/ssl.

Steve


-Original Message-
From: Robert Rhodes [mailto:rrhode...@gmail.com] 
Sent: Tuesday, March 06, 2012 11:13 AM
To: cf-talk
Subject: Re: Failed PCI Compliance test on CF9.01


I just put back the jrun setting to pass cookies securely, and am sending
the jsessionid securely again.  And I am set up to use the database for
client storage.

It's still losing the session when I switch between http and https.

I do have setclientcookies to no, because that sets cfid and cftoken
insecurely which is what caused the PCI test failure.

This really should not be this hard.  I an't be the only person dealing
with this issue.  :(


On Tue, Mar 6, 2012 at 10:44 AM, Donnie Bachan (Gmail) 
donnie.bac...@gmail.com wrote:


 Hi Robert,

 I'm not sure if I'm missing something but shouldn't you have
 setClientCookies to Yes? Otherwise you'd have to pass the JSESSIONID in the
 url on each request.

 Best Regards,
 Donnie Bachan
 Nitendo Vinces - By Striving You Shall Conquer
 ==
 The information transmitted is intended only for the person or entity to
 which it is addressed and may contain confidential and/or privileged
 material. Any review, retransmission, dissemination or other use of, or
 taking of any action in reliance upon, this information by persons or
 entities other than the intended recipient is prohibited. If you received
 this in error, please contact the sender and delete the material from any
 computer.


 On Tue, Mar 6, 2012 at 3:33 PM, Robert Rhodes rrhode...@gmail.com wrote:

 
  For both Phillip and Donnie -- I just set the site up for database
 storage
  for the client session in the cf admin (server settings - client
  variables), and I see data going in those two tables, but I am still
 losing
  the session state when moving from https to http.  I have this set in my
  application.cfm:
 
  clientmanagement=Yes
  sessionmanagement=Yes
  setclientcookies=No
  clientstorage=MyDSN
 
  What am I doing wrong?
 
 


 



~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350273
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

2012-03-06 Thread Pete Freitag

Hi Robert,

You are caught in a bit of a catch 22 here. If you want to set the secure
attribute on session cookies delivered over SSL, but also have it use the
same cookie values over non-ssl - then that defeats the purpose of adding
the secure attribute. If you want to do that you can't use the secure
attribute on the cookies.

The secure attribute says only send this cookie over SSL, so when you make
a request to a non-ssl url the browser will not send the cookie, this
causes ColdFusion to issue a new session.

The best solution is to run all on SSL as Cameron suggested, here's a good
read on the performance of SSL and TLS:
http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html the main
point being that SSL is not as computationally expensive as you may think.

If that's not going to fly then you need to build something to share data
between the sessions, while making sure that the non-ssl data is not
privileged - it can get complicated to ensure that your not opening
yourself up to security issues over non-ssl.

--
Pete Freitag - Adobe Community Professional
http://foundeo.com/ - ColdFusion Consulting Products
http://petefreitag.com/ - My Blog
http://hackmycf.com - Is your ColdFusion Server Secure?

On Tue, Mar 6, 2012 at 2:19 AM, Robert Rhodes rrhode...@gmail.com wrote:

So a site that I built failed PCI compliance testing because the jsessionid
cookie is not set securely.

*-RR*

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive:
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350275
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01

I hear you, but there are issues preventing me from going all https. It's
a long story.

Is there a way to copy, with some code in the application.cfm, the
jsessionid between http and https so we don't lose the session state?

-rr

On Tue, Mar 6, 2012 at 11:24 AM, Pete Freitag p...@foundeo.com wrote:

Hi Robert,

The secure attribute says only send this cookie over SSL, so when you make
a request to a non-ssl url the browser will not send the cookie, this
causes ColdFusion to issue a new session.

--
Pete Freitag - Adobe Community Professional
http://foundeo.com/ - ColdFusion Consulting Products
http://petefreitag.com/ - My Blog
http://hackmycf.com - Is your ColdFusion Server Secure?

On Tue, Mar 6, 2012 at 2:19 AM, Robert Rhodes rrhode...@gmail.com wrote:

So a site that I built failed PCI compliance testing because the
jsessionid
cookie is not set securely.

I found this post

http://thinkinglemur.com/index.php/2009/02/setting-secure-attribute-of-jsessionid-cookie-in-coldfusion-8/
that
shows how to force jrun to do always set the session cookies securely,
but the user loses their session state when they move between secure and
non-secure pages (the jsessionid is different for secure pages). This is
obviously a big problem, since we can't have the entire user session
running under ssl. Any ideas on how to get the jsessionid to be the same
on secure and non-secure pages? I am a little lost here.

*-RR*

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive:
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350277
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


On Tue, Mar 6, 2012 at 11:55 AM, Robert Rhodes rrhode...@gmail.com wrote:

 I hear you, but there are issues preventing me from going all https.  It's
 a long story.

 Is there a way to copy, with some code in the application.cfm, the
 jsessionid between http and https so we don't lose the session state?


You could make this work, but then you would be exactly where you currently
are, and would again fail the PCI audit. I know you are looking for a
quick answer, but there isn't really a great easy option here. Many shops
spend literally months getting compliant, so this code change really
doesn't seem so huge in comparison, even though I know if feel like it is.

You best solution, in the long term as well as the short run, is to make
the code changes and just spend the time and money on it so it's right.

-Cameron

-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350279
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Ok, I am going to try to make the site work all ssl.  I am concerned about
the video streaming over ssl, but I guess we will see how it goes.

On a related subject:  is there a way to make the jsessionid cookie secure
without making the jrun change?  I ask because doing so affects all sites
on the server, and I had planed to run other sites on this particular
server.

On Tue, Mar 6, 2012 at 12:59 PM, Cameron Childress camer...@gmail.comwrote:


 On Tue, Mar 6, 2012 at 11:55 AM, Robert Rhodes rrhode...@gmail.com
 wrote:

  I hear you, but there are issues preventing me from going all https.
  It's
  a long story.
 
  Is there a way to copy, with some code in the application.cfm, the
  jsessionid between http and https so we don't lose the session state?
 

 You could make this work, but then you would be exactly where you currently
 are, and would again fail the PCI audit. I know you are looking for a
 quick answer, but there isn't really a great easy option here. Many shops
 spend literally months getting compliant, so this code change really
 doesn't seem so huge in comparison, even though I know if feel like it is.

 You best solution, in the long term as well as the short run, is to make
 the code changes and just spend the time and money on it so it's right.

 -Cameron

 --
 Cameron Childress
 --
 p:   678.637.5072
 im: cameroncf
 facebook http://www.facebook.com/cameroncf |
 twitterhttp://twitter.com/cameronc |
 google+ https://profiles.google.com/u/0/117829379451708140985


 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350282
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Yes. If it were me, I would turn setClientCookies=false in the
Applciation.cfc|cfm and then set them manually using:

cfcookie name=cfid value=#session.cfid# secure=true/
cfcookie name=cftoken value=#session.cftoken# secure=true/

If you google around a bit you can probably find some sample code for doing
this.  If you are using JSessionIDs (not cfid/cftoken) you'll be just
setting that cookie but I would expect it to work in that case as well.

Whole you're at it you might also pop open Chrome debugging or the like and
verify that those are the only cookies being sent, just to make sure you
don't have something else that trips you up.

-Cameron

On Tue, Mar 6, 2012 at 1:47 PM, Robert Rhodes rrhode...@gmail.com wrote:


 Ok, I am going to try to make the site work all ssl.  I am concerned about
 the video streaming over ssl, but I guess we will see how it goes.

 On a related subject:  is there a way to make the jsessionid cookie secure
 without making the jrun change?  I ask because doing so affects all sites
 on the server, and I had planed to run other sites on this particular
 server.

 On Tue, Mar 6, 2012 at 12:59 PM, Cameron Childress camer...@gmail.com
 wrote:

 
  On Tue, Mar 6, 2012 at 11:55 AM, Robert Rhodes rrhode...@gmail.com
  wrote:
 
   I hear you, but there are issues preventing me from going all https.
   It's
   a long story.
  
   Is there a way to copy, with some code in the application.cfm, the
   jsessionid between http and https so we don't lose the session state?
  
 
  You could make this work, but then you would be exactly where you
 currently
  are, and would again fail the PCI audit. I know you are looking for a
  quick answer, but there isn't really a great easy option here. Many
 shops
  spend literally months getting compliant, so this code change really
  doesn't seem so huge in comparison, even though I know if feel like it
 is.
 
  You best solution, in the long term as well as the short run, is to make
  the code changes and just spend the time and money on it so it's right.
 
  -Cameron
 
  --
  Cameron Childress
  --
  p:   678.637.5072
  im: cameroncf
  facebook http://www.facebook.com/cameroncf |
  twitterhttp://twitter.com/cameronc |
  google+ https://profiles.google.com/u/0/117829379451708140985
 
 
 

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350283
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


That works for cfid and cftoken, thanks.  But it won't work for jsessionid,
because once that is selected in the administrator, it shows up as an
unsecure cookie, even if you have setclientcookies turned off.  That's a
bummer, I wanted to use jsessionids.

On Tue, Mar 6, 2012 at 1:59 PM, Cameron Childress camer...@gmail.comwrote:


 Yes. If it were me, I would turn setClientCookies=false in the
 Applciation.cfc|cfm and then set them manually using:

 cfcookie name=cfid value=#session.cfid# secure=true/
 cfcookie name=cftoken value=#session.cftoken# secure=true/

 If you google around a bit you can probably find some sample code for doing
 this.  If you are using JSessionIDs (not cfid/cftoken) you'll be just
 setting that cookie but I would expect it to work in that case as well.

 Whole you're at it you might also pop open Chrome debugging or the like and
 verify that those are the only cookies being sent, just to make sure you
 don't have something else that trips you up.

 -Cameron

 On Tue, Mar 6, 2012 at 1:47 PM, Robert Rhodes rrhode...@gmail.com wrote:

 
  Ok, I am going to try to make the site work all ssl.  I am concerned
 about
  the video streaming over ssl, but I guess we will see how it goes.
 
  On a related subject:  is there a way to make the jsessionid cookie
 secure
  without making the jrun change?  I ask because doing so affects all sites
  on the server, and I had planed to run other sites on this particular
  server.
 
  On Tue, Mar 6, 2012 at 12:59 PM, Cameron Childress camer...@gmail.com
  wrote:
 
  
   On Tue, Mar 6, 2012 at 11:55 AM, Robert Rhodes rrhode...@gmail.com
   wrote:
  
I hear you, but there are issues preventing me from going all https.
It's
a long story.
   
Is there a way to copy, with some code in the application.cfm, the
jsessionid between http and https so we don't lose the session state?
   
  
   You could make this work, but then you would be exactly where you
  currently
   are, and would again fail the PCI audit. I know you are looking for a
   quick answer, but there isn't really a great easy option here. Many
  shops
   spend literally months getting compliant, so this code change really
   doesn't seem so huge in comparison, even though I know if feel like it
  is.
  
   You best solution, in the long term as well as the short run, is to
 make
   the code changes and just spend the time and money on it so it's right.
  
   -Cameron
  
   --
   Cameron Childress
   --
   p:   678.637.5072
   im: cameroncf
   facebook http://www.facebook.com/cameroncf |
   twitterhttp://twitter.com/cameronc |
   google+ https://profiles.google.com/u/0/117829379451708140985
  
  
  
 
 

 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350285
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Try this:

http://www.12robots.com/index.cfm/2009/5/6/Making-the-JSESSIONID-Session-Token-Cookie-SECURE-and-HTTPOnly-and-settings-its-PATH

-Cameron

On Tue, Mar 6, 2012 at 2:39 PM, Robert Rhodes rrhode...@gmail.com wrote:

 That works for cfid and cftoken, thanks.  But it won't work for jsessionid,
 because once that is selected in the administrator, it shows up as an
 unsecure cookie, even if you have setclientcookies turned off.  That's a
 bummer, I wanted to use jsessionids.



-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350286
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


...also - make sure you've cleared out cookies in your browser after you've
made CF code changes.  Old cookies could be hanging out and screwing up
your testing.

-Cameron

On Tue, Mar 6, 2012 at 2:39 PM, Robert Rhodes rrhode...@gmail.com wrote:

 That works for cfid and cftoken, thanks.  But it won't work for jsessionid,
 because once that is selected in the administrator, it shows up as an
 unsecure cookie, even if you have setclientcookies turned off.  That's a
 bummer, I wanted to use jsessionids.


-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350287
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


 On a related subject:  is there a way to make the jsessionid cookie
 secure without making the jrun change?  I ask because doing so
 affects all sites on the server, and I had planed to run other sites
 on this particular server.

Be careful with this... if your billing system is on this server and
other sites share the same server and aren't properly sandboxed, they
are technically in-scope for compliance as well as they offer other
roads into the server which could lead to the compromise of your
billing system.  All the more reason to isolate it now while you still
can. :)


-Just

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350288
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


Yes, I saw that.  But he does not say how he made the new jsession id
string.  I am sure it is not some random string he pro
grammatically generated.  So, there must be a way to get at the jsessionid
even if you don't have jsessionidenabled in the administrator.

On Tue, Mar 6, 2012 at 2:44 PM, Cameron Childress camer...@gmail.comwrote:


 Try this:


 http://www.12robots.com/index.cfm/2009/5/6/Making-the-JSESSIONID-Session-Token-Cookie-SECURE-and-HTTPOnly-and-settings-its-PATH

 -Cameron

 On Tue, Mar 6, 2012 at 2:39 PM, Robert Rhodes rrhode...@gmail.com wrote:
 
  That works for cfid and cftoken, thanks.  But it won't work for
 jsessionid,
  because once that is selected in the administrator, it shows up as an
  unsecure cookie, even if you have setclientcookies turned off.  That's a
  bummer, I wanted to use jsessionids.



 --
 Cameron Childress
 --
 p:   678.637.5072
 im: cameroncf
 facebook http://www.facebook.com/cameroncf |
 twitterhttp://twitter.com/cameronc |
 google+ https://profiles.google.com/u/0/117829379451708140985


 

~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350289
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01


On Tue, Mar 6, 2012 at 2:56 PM, Robert Rhodes rrhode...@gmail.com wrote:

 Yes, I saw that.  But he does not say how he made the new jsession id
 string.  I am sure it is not some random string he pro
 grammatically generated.  So, there must be a way to get at the jsessionid
 even if you don't have jsessionidenabled in the administrator.


I'd say, enable it in the CFAdmin, tell CF not to set cookies automatically
(via code), then set it yourself.  Are you sure it's getting set as
nonsecure?  That is very suprising to me.

-Cameron

-- 
Cameron Childress
--
p:   678.637.5072
im: cameroncf
facebook http://www.facebook.com/cameroncf |
twitterhttp://twitter.com/cameronc |
google+ https://profiles.google.com/u/0/117829379451708140985


~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: 
http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:350290
Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm

Re: Failed PCI Compliance test on CF9.01