ColdFusion Session Tracking http vs https
<p>Anytime a user tries to access our site with http, they are redirected to https via this code in the Application.cfc:</p>

<pre><code>    If (CGI.HTTPS != "on") {
        location(url="https://#Application.PortalApp.GetDomain()##CGI.SCRIPT_NAME#?#CGI.QUERY_STRING#", addtoken="false");
    }
</code></pre>

<p>The strange thing is, if they have never accessed the site via http, but happen to click an internal link that points to http instead of https, they are logged out.  However, once they login again, they can then access an http link, get redirected to https and stay logged into the system.</p>

<p>I did some line-by-line debugging and the https session gets overwritten when a user access http.  But once a user accesses http, the https shares the sessionid.  </p>

<p>Is this correct behavior?</p>

<p>In ColdFusion Administrator Session settings, HTTPOnly is set to true, and secure cookie is set to false.</p>